24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 86:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 0849b85e16da… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0849b85e16da…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/27 AV engines flagged this file. 13 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a"],"about":{"@type":"SoftwareApplication","name":"cooker.exe","applicationCategory":["peexe","executable"],"identifier":"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T723,"kitty_portable.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '6503248'}" (UID: 00000000-00004036) "kitty_portable.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '6503168'}" (UID: 00000000-00004036) "kitty_portable.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '6506928'}" (UID: 00000000-00004036) "kitty_portable.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '6502136'}" (UID: 00000000-00004036) "kitty_portable.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '6502096'}" (UID: 00000000-00004036) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895864'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895672'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895896'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895624'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895880'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895608'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895656'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895912'}" (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895640'}" (UID: 00000000-00004032)26:Tfd8,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp")27:Tc6f,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp")28:T9ad,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp")29:T18f2,"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\Documents\Amazon Downloader Logs\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt.WNCRYT" to "%USERPROFILE%\Documents\Amazon Downloader Logs\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst.WNCRYT" to "%USERPROFILE%\Documents\Outlook Files\Outlook.pst.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\Documents\Database1.accdb.WNCRYT" to "%USERPROFILE%\Documents\Database1.accdb.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\TorService\tor\pluggable_transports\bridges_list.obfs4.txt.WNCRYT" to "C:\TorService\tor\pluggable_transports\bridges_list.obfs4.txt.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT" to "%USERPROFILE%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Bears.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Garden.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\HandPrints.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Monet.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Notebook.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Peacock.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Psychedelic.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Roses.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Small_News.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\SoftBlue.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Stars.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\Tanspecks.jpg.WNCRY" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg.WNCRY"2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2b:T92f,Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CertGetNameStringA" (Indicator: "CertGetNameString"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe")2c:T815,Found string "Private key file for authentication:" (Indicator: "private key"; Source: "00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp") Found string "Select private key file" (Indicator: "private key"; Source: "00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "public key hash: sha256//%s" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "SSL: public key does not match pinned public key!" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "RSA Public Key (%lu bits)" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "RSA Public Key" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "Public Key Algorithm" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "Public Key Algorithm: %s" (Indicator: "public key"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "CryptoAPI Private Key" (Indicator: "private key"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp")2d:T553,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Commandline contains long base64 encoded string Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to encrypt data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains reference to cryptographic keys Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption2e:T9f8,file/memory contains long string with (Indicator: "sendmessage"; File: "@WanaDecryptor@.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00000844-00000C2B-3458667144") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004036-00000C2B-3462020143") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004036-00000C2B-3462029789") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp")2f:T932,"kitty_portable.exe" called "GetWindowTextA" (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&Open" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Start" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&Cancel" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&About" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Check Update" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Cate&gory:" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Host &Name (or IP address)" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&Port" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Connection type:" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&SSH" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Se&rial" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "O&ther:" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Specify the destination you want to connect to" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Sav&ed Sessions/New Folder" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&Load" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Sa&ve (d)" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "&Delete" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "New folder" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Load, save or delete a stored session" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Close window on e&xit:" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Always" - (UID: 00000000-00004036) "kitty_portable.exe" called "GetWindowTextW" with parameter "Never" - (UID: 00000000-00004036)30:T259e,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000980000000300000044e55e01aa5adc99f40f00008ce55e01c0e45e01490000000300000048e45e0150e45e0118e65e01b0bf656b0e2fe5f3feffffff98e55e012fe9646b9800000098e55e013ce9646b060000000000886a010000004fe9646b3333ff040600000000000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e55e01000000008e00000044e65e01feffffffcce55e01cf006377d600637709fe77768e0000004700000044e65e0100000000a0e55e010000000008e65e01 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600138db59a44de5e016d825f761c82210004010000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340066006300380039006500630033003700330066006400390066003400320064006300360063006600610036003100660035003500390032003700390032006200660034003800390039003100660031006500380064003500340034006400330061002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b627735d37776d8eb5476ac011b0000001b0000000000000000000300ed00d1000000000000000000000000000000000000000400e800d10000000000000000000000786f1b0000000000200000000000000000000000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b00e8cc2300000000003e00003e340000c010cf230088e62300c07c2300f001000000001b0004000000e8cc2300acee5e010464627738011b00e063627769f577760000000000001b00f0cc23006dd12d775c23d49a6cae48770000000000000000e401000088e62300482f1b000100000000001b0050011b000c000000f0cc2300482f1b0002000002180000002c21000d820000000000000000000000030000004cee5e01820000007f070000000000002c21000d02000000c075357788e6230000000000c075357768ee5e0158301b0000000000482f1b00c0ee5e01ff2b6277 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b0017003a008d000000ff0700008e010000322f001de81b2400180038008d0000000200000008000000786f1b00e88e200004000000000000000000000060eb1e00686c1b007c6d1b0050b12000f86f1b0095e15e7750e41200feffffffc4ff120095e15e77d5074b00feffffffff2b62779a2a6277bc922000fc821976bc92200088ea230004000000000000000000000060eb1e00686c1b007c6d1b0040b12000f86f1b0080e51200000000008e000000d0e51200feffffff58e51200cf006377d60063779dfe3b778e00000047000000d0e51200000000002ce5120095e15e77 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b00d09220000000000002000002340000c0f894200008752100c4001b001000000000001b0040000000d09220007ce712000464627738011b00e0636277b9fc3b770000000000001b00d89220006dd12d772c2a989b6cae48770000000000000000d8becf75e81b240050011b000100000000001b0050011b000c000000d892200050011b000200000218000000c60000c6460000000000000000000000030000001ce71200800000004600000000000000322f001d46000000c07535775886240000000000c075357738e71200742f1b0000000000482f1b0090e71200ff2b6277 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002300607423005b742300000000000000000000001b0000000001b4d712000000000018e5120095e15e77ed094b00feffffff435c627750596277aa000000b80000005a742300587423003cd9120074dd120000000000000000000000000000000000000000000000000000000000000000001c5c617760d87975ffffffff17000000ecd812002400000003000000dcdd120008e3120074dd12008600000018d9120096ed627782742300a06a3875860000003cd9120074dd12000000000086008800a06a38753cd91200916c387582742300a06a3875a06a3875acdd120002020000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b0017000e00d0000000ff07000096010000322b0019a81d240018000c00d00000000200000008000000786f1b007857200004000000000000000000000060eb1e00686c1b007c6d1b00f0af2000f86f1b0095e15e7750e41200feffffffc4ff120095e15e77d5074b00feffffffff2b62779a2a62774c5b2000fc8219764c5b20008812210004000000000000000000000060eb1e00686c1b007c6d1b00d0af2000f86f1b0080e51200000000008e000000d0e51200feffffff58e51200cf006377d60063779dfe3b778e00000047000000d0e51200000000002ce5120095e15e77 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b00a01d2400000000004a00004a340000c0c81f2400609e200078e320005002000000001b0000400000a01d24007ce712000464627738011b00e0636277b9fc3b770000000000001b00a81d24006dd12d772c2a989b6cae48770000000000000000d8becf75609e2000482f1b000100000000001b0050011b000c000000a81d2400482f1b000200000218000000970000978e0000000000000000000000030000001ce712008e0000001700000000000000322b00190e000000c075357758a6240000000000c075357738e712006c2f1b0000000000482f1b0090e71200ff2b6277 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001b0017001c0013010000ff07000096010000aa220088a81d240018002200130100000200000008000000786f1b007857200004000000000000000000000060eb1e00686c1b007c6d1b00a0b02000f86f1b0095e15e7750e41200feffffffc4ff120095e15e77d5074b00feffffffff2b62779a2a62774c5b2000fc8219764c5b20008812210004000000000000000000000060eb1e00686c1b007c6d1b0050b02000f86f1b0080e51200000000008e000000d0e51200feffffff58e51200cf006377d60063779dfe3b778e00000047000000d0e51200000000002ce5120095e15e77 (UID: 00000000-00005888)31:T10e2,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5476983f21000060fd7f9a5c637700e0fd7fb0c95e014460fd7f00000000400000003f000000230000000060fd7fa4c95e01c15c637760826a77230000000060fd7f9a5c637700e0fd7fc8c95e015789627780836a7713177a75d8eb5476 (UID: 00000000-00005888) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000220000000000000000000000240000000d0000000000000001000000f4e9340080000000000000000000000022000000000000000000000024000000020000000000000000000000f8ea340018000000000000000000000022000000000000000000000024000000 (UID: 00000000-00000844) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e15e7712214b00fefffffff5f66277634d6377e82433001015d06c8808d000b2f462773ec152771ce97b000000cf6c0000cf6c804d63771ac15277f0000000f000cf6c0000000088e87b005c0043001cea7b000000000001000000ece87b0040f562770000000000000000d8e87b00 (UID: 00000000-00000844) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000880000000000000088e87b00459d94750000830000000000800000000200000000007c00dc1acf6c9ce87b00 (UID: 00000000-00000844) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000844) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5476201e39010030fd7f9a5c637700f0fa7fc0d201054430fd7f00000000400000003f000000250000000030fd7fb4d20105c15c637760826a77250000000030fd7f9a5c637700f0fa7fd8d201055789627780836a7713177a75d8eb5476 (UID: 00000000-00000844) "kitty_portable.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6627720c70b77f42eda7178008000a035da7150c70b777cf1220090ef7f00b2f4627740c70b778cf122000000d3710000d37100000000e8f02200f0000000f000d37100000000f8f02200530000008cf2220000000000010000005cf1220040f56277000000000000000048f12200 (UID: 00000000-00004036) "kitty_portable.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004036) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb5476680520000080fd7f9a5c637700f0fd7f00f012004480fd7f00000000400000003f000000160000000080fd7ff4ef1200c15c637760826a77160000000080fd7f9a5c637700f0fd7f18f012005789627780836a7713177a75d8eb5476 (UID: 00000000-00004904) "icacls.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb547640f5180000b0fd7f9a5c637700f0fd7f48e4080044b0fd7f00000000400000003f0000000900000000b0fd7f3ce40800c15c637760826a770900000000b0fd7f9a5c637700f0fd7f60e408005789627780836a7713177a75d8eb5476 (UID: 00000000-00003824)32:T504,Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp")33:T811,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "kitty_portable.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "AutoClicker-3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Cyber Sniff.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Cyber Sniff.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "taskdl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T860,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp")35:T559,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004904.00000000.285267.0040F000.00000004.mdmp")36:T8ad,Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "22369017714400,3440,105,,GetForegroundWindow,user32.dll,"253:00:44.779",RX=0,PX=0" (Indicator: "GetForegroundWindow"; Source: "00000000-00004032.00000002.288844.00970000.00000004.mdmp")37:T518,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp")38:T754,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")39:Tb08,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KITTY_PORTABLE.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KITTY_PORTABLE.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\AUTOCLICKER-3.1.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\AUTOCLICKER-3.1.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CYBER SNIFF.EXE") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CYBER SNIFF.EXE") "Cyber Sniff.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINDOWSUPDATEDAEMON.EXE") "Cyber Sniff.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINDOWSUPDATEDAEMON.EXE") "Cyber Sniff.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PACKED.EXE") "Cyber Sniff.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PACKED.EXE") "Cyber Sniff.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CYBERSNIFF.EXE") "Cyber Sniff.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CYBERSNIFF.EXE") "Cyber Sniff.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "Cyber Sniff.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE")3a:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3b:T5a7,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3c:T1039,"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileA" to copy u.wnry to new location @WanaDecryptor@.exe (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location %USERPROFILE%\Documents\@WanaDecryptor@.exe (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\Amazon Downloader Logs\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Documents\Amazon Downloader Logs\@WanaDecryptor@.exe.lnk (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\Outlook Files\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Documents\Outlook Files\@WanaDecryptor@.exe.lnk (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\@WanaDecryptor@.exe (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\TorService\tor\pluggable_transports\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\TorService\tor\pluggable_transports\@WanaDecryptor@.exe (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Microsoft\User Account Pictures\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Microsoft\User Account Pictures\Default Pictures\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Microsoft\User Account Pictures\Default Pictures\@WanaDecryptor@.exe.lnk (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Microsoft\Windows\Caches\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Microsoft\Windows\Ringtones\@Please_Read_Me@.txt (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Microsoft\Windows\Ringtones\@WanaDecryptor@.exe.lnk (UID: 00000000-00004904)3d:T735,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005888) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00000844) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00000844) "kitty_portable.exe" called "CreateDirectoryA" with parameter 433a (UID: 00000000-00004036) "kitty_portable.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00004036) "kitty_portable.exe" called "CreateDirectoryA" with parameter C:\Users\ZGA2Y4g (UID: 00000000-00004036) "kitty_portable.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00004036) "kitty_portable.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004036) "kitty_portable.exe" called "CreateDirectoryA" with parameter %APPDATA%\Sessions (UID: 00000000-00004036) "kitty_portable.exe" called "CreateDirectoryA" with parameter %APPDATA%\Proxies (UID: 00000000-00004036) "AutoClicker-3.1.exe" called "CreateDirectoryW" with parameter %APPDATA%\ACLib (UID: 00000000-00004032) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateDirectoryW" with parameter Z:\$RECYCLE (UID: 00000000-00004904) "Cyber Sniff.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004200) "cscript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005776) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003144) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003144)3e:T7ac,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlA" - (UID: 00000000-00005888), "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "CreateProcessW" with parameter ""%APPDATA%\kitty_portable.exe"" - (UID: 00000000-00005888), "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "CreateProcessW" with parameter ""%APPDATA%\AutoClicker-3.1.exe"" - (UID: 00000000-00005888), "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "CreateProcessW" with parameter ""%APPDATA%\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"" - (UID: 00000000-00005888), "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "CreateProcessW" with parameter ""%APPDATA%\Cyber Sniff.exe"" - (UID: 00000000-00005888), "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateProcessA" with parameter "attrib +h ." - (UID: 00000000-00004904), "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateProcessA" with parameter "icacls . /grant Everyone:F /T /C /Q" - (UID: 00000000-00004904), "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateProcessA" with parameter "taskdl.exe" - (UID: 00000000-00004904), "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateProcessA" with parameter "@WanaDecryptor@.exe fi" - (UID: 00000000-00004904), "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateProcessA" with parameter "4161747737355.bat" - (UID: 00000000-00004904), "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "CreateProcessA" with parameter "attrib +h +s Z:\$RECYCLE" - (UID: 00000000-00004904)3f:Taf2f,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005888) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000844) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000844) "kitty_portable.exe" called "LoadLibrary" with a parameter ADVAPI32.DLL (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter COMDLG32.DLL (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter IMM32.DLL (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter OLE32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter SHELL32.DLL (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter WSOCK32.DLL (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\comctl32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Shell32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\user32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winmm.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\secur32.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sspicli.dll (UID: 00000000-00004036) "kitty_portable.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00004036) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004032) "AutoClicker-3.1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004032) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter MSVCRT.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter MSVCP60.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter %APPDATA%\4161747737355.bat (UID: 00000000-00004904) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004904) "Cyber Sniff.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004200) "Cyber Sniff.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00004200) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cscript.exe (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005776) "cscript.exe" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00005776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003144) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003144) "taskdl.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003804) "taskdl.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003804) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003804) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003804) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003804) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003804) "taskdl.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002804) "taskdl.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002804) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002804) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002804) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002804) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002804)40:T968,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "8618512806427,3576,3142,,CreateProcessW,kernel32.dll,"253:00:15.217",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004200.00000001.286984.002B0000.00000004.mdmp") Found reference to API "5491002406267,3576,3142,,CreateProcessW,kernel32.dll,"253:00:07.323",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004200.00000001.286984.002B0000.00000004.mdmp") Found reference to API "7317842039568,3576,3142,,CreateProcessW,kernel32.dll,"253:00:11.769",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004200.00000001.286984.002B0000.00000004.mdmp") Found reference to API "3627470635168,4472,3142,,CreateProcessW,kernel32.dll,"253:00:02.831",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00004200.00000001.286984.002B0000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp")41:T738,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; File: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp")42:T4ab,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "8618512806528,3576,3184,,ShellExecuteA,Shell32.dll,"253:00:15.217",RX=0,PX=0" (Indicator: "ShellExecute"; Source: "00000000-00004200.00000001.286984.002B0000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp")43:T71b,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp")44:T596,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp")45:T5c8,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp")46:T4b9,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp")47:T6ce,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004904.00000000.285267.00408000.00000002.mdmp")48:T54f,"%USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\*" (Indicator: "%userprofile%\microsoft\windows\start menu\programs\startup\*") in Source: 00000000-00004904-00000C2D-3118589975819 ".\Microsoft\Windows\Start Menu\Programs\Startup\*" (Indicator: ".\microsoft\windows\start menu\programs\startup\*") in Source: 00000000-00003824-00000C2D-27132886043520 ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004200.00000001.286984.002B0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004200.00000001.286984.002B0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004200.00000001.286984.002B0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004200.00000001.286984.002B0000.00000004.mdmp49:T6c0,"Software\AutoIt v3\AutoIt" in Source: 00000000-00004032.00000001.286920.00482000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004032.00000001.286920.00482000.00000002.mdmp "HKCR\" in Source: 00000000-00004032.00000001.286920.00482000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004032.00000001.286920.00482000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00004200.00000001.286984.002B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004200.00000001.286984.002B0000.00000004.mdmp "SOFTWARE\dotnet" in Source: 00000000-00004200.00000001.286984.027C0000.00000004.mdmp "HKCU\" in Source: 00000000-00004200.00000001.286984.027C0000.00000004.mdmp "HKLM\" in Source: 00000000-00004200.00000001.286984.027C0000.00000004.mdmp "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004904.00000000.285267.00180000.00000004.mdmp 00000000-00004904.00000000.285267.10000000.00000004.mdmp 00000000-00004904.00000001.287193.001EC000.00000004.mdmp 00000000-00004904.00000001.287193.1000C000.00000004.mdmp 00000000-00004904.00000002.289114.001E8000.00000004.mdmp 00000000-00004904.00000002.289114.1000C000.00000004.mdmp "0817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004904.00000001.287193.00180000.00000004.mdmp 00000000-00004904.00000002.289114.00180000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00004904.00000001.287193.001EC000.00000004.mdmp4a:Tf70,"powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "kitty_portable.exe" failed to load missing module "%WINDIR%\system32\shcore.dll" - [base:0; Status:c0000135] "AutoClicker-3.1.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AutoClicker-3.1.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cscript.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cscript.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "taskdl.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "taskdl.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]4b:T6f44,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "KERNEL32.DLL" at base 77290000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "SHELL32.DLL" at base 76640000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "OLE32.DLL" at base 76050000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "PROPSYS.DLL" at base 741f0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "COMCTL32.DLL" at base 743a0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "OLEAUT32.DLL" at base 75850000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "APPHELP.DLL" at base 75380000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a880000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77290000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "SETUPAPI.DLL" at base 75eb0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "RPCRT4.DLL" at base 773d0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 741f0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "NTMARTA.DLL" at base 74940000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e90000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "PROFAPI.DLL" at base 754e0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 756e0000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77480000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "SECUR32.DLL" at base 75200000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75780000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6f530000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e60000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 77290000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "SHLWAPI.DLL" at base 765e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74970000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 696c0000 "powershell.exe" loaded module "USER32.DLL" at base 759f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 6a700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 77740000 "powershell.exe" loaded module "RPCRT4.DLL" at base 773d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6a700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 64290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 76050000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68c60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6a530000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 61330000 "powershell.exe" loaded module "NTDLL.DLL" at base 775d0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cd80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 76640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 757e0000 "powershell.exe" loaded module "MSISIP.DLL" at base 6f520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75520000 "powershell.exe" loaded module "IMM32.DLL" at base 77720000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6ccf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6d390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 60b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6a1d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 632b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 68b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 68a00000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a140000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6c0e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 68980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 688c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 68870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 686c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 68820000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 75200000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 63040000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75e90000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 68630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 60930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6c380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 756e0000 "powershell.exe" loaded module "URLMON.DLL" at base 77480000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75780000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6f530000 "powershell.exe" loaded module "NCRYPT.DLL" at base 75010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74bb0000 "powershell.exe" loaded module "USERENV.DLL" at base 75500000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e90000 "powershell.exe" loaded module "GPAPI.DLL" at base 74ab0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75e90000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75e90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71570000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71570000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6c370000 "powershell.exe" loaded module "WINHTTP.DLL" at base 70e00000 "powershell.exe" loaded module "WS2_32.DLL" at base 75810000 "powershell.exe" loaded module "CREDSSP.DLL" at base 74b70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ea0000 "powershell.exe" loaded module "WSHTCPIP" at base 74a00000 "powershell.exe" loaded module "WSHIP6.DLL" at base 74e90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71c80000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 73830000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base 73740000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base 736c0000 "powershell.exe" loaded module "NSI.DLL" at base 75900000 "powershell.exe" loaded module "CFGMGR32.DLL" at base 75670000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75e90000 "powershell.exe" loaded module "PROFAPI.DLL" at base 754e0000 "powershell.exe" loaded module "DNSAPI.DLL" at base 74d60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74e90000 "powershell.exe" loaded module "RASADHLP.DLL" at base 71c30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 737a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 75520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 62f30000 "powershell.exe" loaded module "GDI32.DLL" at base 75e40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 74ff0000 "kitty_portable.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "kitty_portable.exe" loaded module "COMDLG32.DLL" at base 76560000 "kitty_portable.exe" loaded module "GDI32.DLL" at base 75e40000 "kitty_portable.exe" loaded module "IMM32.DLL" at base 77720000 "kitty_portable.exe" loaded module "MSVCRT.DLL" at base 75940000 "kitty_portable.exe" loaded module "OLE32.DLL" at base 76050000 "kitty_portable.exe" loaded module "PSAPI.DLL" at base 77740000 "kitty_portable.exe" loaded module "SHELL32.DLL" at base 76640000 "kitty_portable.exe" loaded module "USER32.DLL" at base 759f0000 "kitty_portable.exe" loaded module "WSOCK32.DLL" at base 70c30000 "kitty_portable.exe" loaded module "WTSAPI32.DLL" at base 73890000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77290000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32.DLL" at base 75810000 "kitty_portable.exe" loaded module "KERNEL32.DLL" at base 77290000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\COMCTL32.DLL" at base 71d30000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76640000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "kitty_portable.exe" loaded module "DWMAPI.DLL" at base 73d20000 "kitty_portable.exe" loaded module "COMCTL32.DLL" at base 743a0000 "kitty_portable.exe" loaded module "UXTHEME.DLL" at base 74300000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76050000 "kitty_portable.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "kitty_portable.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77750000 "kitty_portable.exe" loaded module "OLEAUT32.DLL" at base 75850000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 759f0000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\WINMM.DLL" at base 6e6e0000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 0 "kitty_portable.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "kitty_portable.exe" loaded module "SSPICLI.DLL" at base 75360000 "kitty_portable.exe" loaded module "RPCRT4.DLL" at base 773d0000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\SECUR32.DLL" at base 75200000 "kitty_portable.exe" loaded module "%WINDIR%\SYSTEM32\SSPICLI.DLL" at base 75360000 "kitty_portable.exe" loaded module "COMCTL32" at base 743a0000 "AutoClicker-3.1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e60000 "AutoClicker-3.1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "AutoClicker-3.1.exe" loaded module "KERNEL32" at base 77290000 "AutoClicker-3.1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "AutoClicker-3.1.exe" loaded module "UXTHEME.DLL" at base 74300000 "AutoClicker-3.1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "AutoClicker-3.1.exe" loaded module "OLE32.DLL" at base 76050000 "AutoClicker-3.1.exe" loaded module "KERNEL32.DLL" at base 77290000 "AutoClicker-3.1.exe" loaded module "COMCTL32.DLL" at base 743a0000 "AutoClicker-3.1.exe" loaded module "OLEAUT32.DLL" at base 75850000 "AutoClicker-3.1.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "AutoClicker-3.1.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77290000 "AutoClicker-3.1.exe" loaded module "SETUPAPI.DLL" at base 75eb0000 "AutoClicker-3.1.exe" loaded module "RPCRT4.DLL" at base 773d0000 "AutoClicker-3.1.exe" loaded module "SHELL32.DLL" at base 76640000 "AutoClicker-3.1.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "AutoClicker-3.1.exe" loaded module "DWMAPI.DLL" at base 73d20000 "AutoClicker-3.1.exe" loaded module "IMM32.DLL" at base 77720000 "AutoClicker-3.1.exe" loaded module "COMCTL32" at base 743a0000 "AutoClicker-3.1.exe" loaded module "USER32.DLL" at base 759f0000 "AutoClicker-3.1.exe" loaded module "GDI32.DLL" at base 75e40000 "AutoClicker-3.1.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76050000 "AutoClicker-3.1.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "AutoClicker-3.1.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77750000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "KERNEL32.DLL" at base 77290000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "USER32.DLL" at base 759f0000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "SHELL32.DLL" at base 76640000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "MSVCRT.DLL" at base 75940000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "MSVCP60.DLL" at base 684f0000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "NTMARTA.DLL" at base 74940000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75e90000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "RPCRT4.DLL" at base 773d0000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "OLE32.DLL" at base 76050000 "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" loaded module "SSPICLI.DLL" at base 75360000 "Cyber Sniff.exe" loaded module "OLE32.DLL" at base 76050000 "Cyber Sniff.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "Cyber Sniff.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "Cyber Sniff.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "Cyber Sniff.exe" loaded module "PROPSYS.DLL" at base 741f0000 "Cyber Sniff.exe" loaded module "COMCTL32.DLL" at base 743a0000 "Cyber Sniff.exe" loaded module "OLEAUT32.DLL" at base 75850000 "Cyber Sniff.exe" loaded module "APPHELP.DLL" at base 75380000 "Cyber Sniff.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "Cyber Sniff.exe" loaded module "KERNEL32.DLL" at base 77290000 "Cyber Sniff.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a880000 "Cyber Sniff.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77290000 "Cyber Sniff.exe" loaded module "SETUPAPI.DLL" at base 75eb0000 "Cyber Sniff.exe" loaded module "RPCRT4.DLL" at base 773d0000 "Cyber Sniff.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 741f0000 "Cyber Sniff.exe" loaded module "NTMARTA.DLL" at base 74940000 "Cyber Sniff.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e90000 "Cyber Sniff.exe" loaded module "PROFAPI.DLL" at base 754e0000 "Cyber Sniff.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 756e0000 "Cyber Sniff.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77480000 "Cyber Sniff.exe" loaded module "SECUR32.DLL" at base 75200000 "Cyber Sniff.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75780000 "Cyber Sniff.exe" loaded module "SHELL32.DLL" at base 76640000 "Cyber Sniff.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "Cyber Sniff.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6f530000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77290000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75380000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e60000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cscript.exe" loaded module "KERNEL32" at base 77290000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "cscript.exe" loaded module "RPCRT4.DLL" at base 773d0000 "cscript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75e90000 "cscript.exe" loaded module "ADVAPI32.DLL" at base 75ac0000 "cscript.exe" loaded module "KERNEL32.DLL" at base 77290000 "cscript.exe" loaded module "SXS.DLL" at base 753e0000 "cscript.exe" loaded module "DWMAPI.DLL" at base 73d20000 "cscript.exe" loaded module "CLBCATQ.DLL" at base 75b70000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 63230000 "cscript.exe" loaded module "OLE32.DLL" at base 76050000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ac0000 "cscript.exe" loaded module "WINTRUST.DLL" at base 757e0000 "cscript.exe" loaded module "CRYPTSP.DLL" at base 74ee0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74c70000 "cscript.exe" loaded module "CRYPTBASE.DLL" at base 753d0000 "cscript.exe" loaded module "MSISIP.DLL" at base 6f520000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75520000 "cscript.exe" loaded module "IMM32.DLL" at base 77720000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6ccf0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 6ba40000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6b960000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76640000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 741f0000 "cscript.exe" loaded module "NTMARTA.DLL" at base 74940000 "cscript.exe" loaded module "COMCTL32.DLL" at base 743a0000 "cscript.exe" loaded module "PROPSYS.DLL" at base 741f0000 "cscript.exe" loaded module "OLEAUT32.DLL" at base 75850000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77290000 "cscript.exe" loaded module "SETUPAPI.DLL" at base 75eb0000 "cscript.exe" loaded module "SHELL32.DLL" at base 76640000 "cscript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75e90000 "cscript.exe" loaded module "PROFAPI.DLL" at base 754e0000 "cscript.exe" loaded module "LINKINFO.DLL" at base 6e910000 "cscript.exe" loaded module "USER32.DLL" at base 759f0000 "cscript.exe" loaded module "NTSHRUI.DLL" at base 72320000 "cscript.exe" loaded module "SRVCLI.DLL" at base 750d0000 "cscript.exe" loaded module "CSCAPI.DLL" at base 70ba0000 "cscript.exe" loaded module "SLC.DLL" at base 73880000 "cscript.exe" loaded module "SHLWAPI.DLL" at base 765e0000 "cscript.exe" loaded module "NETUTILS.DLL" at base 742f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 63220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 68900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6a400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 6a2d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ccc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6a1e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6a160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 68840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 630d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6c0f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 68780000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 62f30000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6d460000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 686f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6ba40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 60aa0000 "taskdl.exe" loaded module "GDI32.DLL" at base 75e40000 "taskdl.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77720000 "taskdl.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70e60000 "taskdl.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "taskdl.exe" loaded module "KERNEL32" at base 77290000 "taskdl.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "taskdl.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c4100004c:T1445,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "cscript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "cscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}") "cscript.exe" touched "Windows Script Host Shell Object" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}") "cscript.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS")4d:T149c,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 8,nop ,mov eax, 4,push eax,mov eax, 0,push eax,lea eax, [ebp - 4],push eax,call 0x401678,add esp, 0xc,mov eax, 0x40152b,push eax,call 0x4016c0,mov eax, 1,push eax,call 0x4016c8,add esp, 4,mov eax, 0x30000,push eax,mov eax, 0x10000,push eax,call 0x4016d0,add esp, 8,mov eax, dword ptr [0x14eaf58],mov ecx, dword ptr [0x14eaf5c],mov edx, dword ptr [0x14eaf60],mov dword ptr [ebp - 8], eax," "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40d488,push 0x4076f4,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x4081c4],pop ecx,or dword ptr [0x40f94c], 0xffffffff,or dword ptr [0x40f950], 0xffffffff,call dword ptr [0x4081c0],mov ecx, dword ptr [0x40f948],mov dword ptr [eax], ecx,call dword ptr [0x4081bc],mov ecx, dword ptr [0x40f944],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4081b8]," "AutoClicker-3.1.exe" file has an entrypoint instructions - "call 0x4223bc,jmp 0x416193,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push edi,push esi,mov esi, dword ptr [ebp + 0xc],mov ecx, dword ptr [ebp + 0x10],mov edi, dword ptr [ebp + 8],mov eax, ecx,mov edx, ecx,add eax, esi,cmp edi, esi,jbe 0x416340,cmp edi, eax,jb 0x4164e4,cmp ecx, 0x100,jb 0x416367,cmp dword ptr [0x4a94e0], 0,je 0x416367,push edi,push esi,and edi, 0xf,and esi, 0xf,cmp edi, esi,pop esi,pop edi,jne 0x416367,pop esi,pop edi,pop ebp,jmp 0x4167cc,test edi, 3,jne 0x416384,shr ecx, 2," "kitty_portable.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x583015,lea edi, [esi - 0x182015],mov dword ptr [edi + 0x1da58c], 0x68644dfc,push edi,jmp 0x631dba,nop ,nop ,nop ,nop ,nop ,nop ,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x631dc1,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x631db0,mov eax, 1,add ebx, ebx,jne 0x631dd3,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x631de4,jne 0x631e03,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x631e03,dec eax,add ebx, ebx,jne 0x631df0,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,jmp 0x631dc8," "WindowsUpdateDaemon.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140067714,add rsp, 0x28,jmp 0x140066c9c,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x140066e44,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx,mov r11d, dword ptr [r8],mov rbx, rdx,and r11d, 0xfffffff8,mov r9, rcx,test byte ptr [r8], 4,mov r10, rcx,je 0x140066e6f,mov eax, dword ptr [r8 + 8],movsxd r10, dword ptr [r8 + 4],neg eax,add r10, rcx,movsxd rcx, eax,and r10, rcx,movsxd rax, r11d," "@WanaDecryptor@.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x41baa8,push 0x413050,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x415524],pop ecx,or dword ptr [0x422298], 0xffffffff,or dword ptr [0x42229c], 0xffffffff,call dword ptr [0x415520],mov ecx, dword ptr [0x42228c],mov dword ptr [eax], ecx,call dword ptr [0x41551c],mov ecx, dword ptr [0x422288],mov dword ptr [eax], ecx,mov eax, dword ptr [0x415518]," "CyberSniff.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400144cc,add rsp, 0x28,jmp 0x140013c6c,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x140013e24,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx,mov r11d, dword ptr [r8],mov rbx, rdx,and r11d, 0xfffffff8,mov r9, rcx,test byte ptr [r8], 4,mov r10, rcx,je 0x140013e4f,mov eax, dword ptr [r8 + 8],movsxd r10, dword ptr [r8 + 4],neg eax,add r10, rcx,movsxd rcx, eax,and r10, rcx,movsxd rax, r11d," "taskdl.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4020a8,push 0x401a7c,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x40208c],pop ecx,or dword ptr [0x403084], 0xffffffff,or dword ptr [0x403088], 0xffffffff,call dword ptr [0x402088],mov ecx, dword ptr [0x403080],mov dword ptr [eax], ecx,call dword ptr [0x402084],mov ecx, dword ptr [0x40307c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x402080]," "taskse.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x402070,push 0x401540,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x402050],pop ecx,or dword ptr [0x4031b4], 0xffffffff,or dword ptr [0x4031b8], 0xffffffff,call dword ptr [0x40204c],mov ecx, dword ptr [0x4031b0],mov dword ptr [eax], ecx,call dword ptr [0x402048],mov ecx, dword ptr [0x4031ac],mov dword ptr [eax], ecx,mov eax, dword ptr [0x402044],"4e:T970,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA")4f:Tf34,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005888-00000C2A-3452329524] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000844-00000C2A-3455910388] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000844-00000C2A-3456433837] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000844-00000C2A-3456536984] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000844-00000C2A-3457005231] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000844-00000C2A-3457029466] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00000844-00000C2A-3457080755] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000844-00000C2A-3457161177] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000844-00000C2A-3457214583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00000844-00000C2A-3457364629] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00000844-00000C2A-3457626896] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000844-00000C2A-3458089174] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000844-00000C2A-3458116534] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00000844-00000C2A-3458554597] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000844-00000C2A-3459024214] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000844-00000C2A-3459052575] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00000844-00000C2A-3459132332] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000844-00000C2A-3459367496] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00000844-00000C2A-3459523631] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00000844-00000C2A-3459743823] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00000844-00000C2A-3459771507] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00000844-00000C2A-3459807677] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll" [Source: 00000000-00000844-00000C2A-3459993802] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll" [Source: 00000000-00000844-00000C2A-3460198344] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" [Source: 00000000-00000844-00000C2A-3460341902]50:T834,Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGU ..." (UID: 00000000-00000844, Additional Context: "<#icd#>Add-MpPreference <#bth#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#juh#> -Force <#dew#>"), Spawned process "kitty_portable.exe" (UID: 00000000-00004036), Spawned process "AutoClicker-3.1.exe" (UID: 00000000-00004032), Spawned process "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" (UID: 00000000-00004904), Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00002612), Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00003824), Spawned process "Cyber Sniff.exe" (UID: 00000000-00004200), Spawned process "taskdl.exe" (UID: 00000000-00003376), Spawned process "cmd.exe" with commandline "/c 4161747737355.bat" (UID: 00000000-00002852), Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00005776), Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00005968), Spawned process "taskdl.exe" (UID: 00000000-00004408), Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAG4AaABtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGU ..." (UID: 00000000-00003144, Additional Context: "<#nhm#>Add-MpPreference <#pbw#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#rgx#> -Force <#nmx#>"), Spawned process "taskdl.exe" (UID: 00000000-00000708), Spawned process "taskdl.exe" (UID: 00000000-00003632), Spawned process "taskdl.exe" (UID: 00000000-00003804), Spawned process "taskdl.exe" (UID: 00000000-00002804), Spawned process "taskdl.exe" (UID: 00000000-00000608), Spawned process "taskdl.exe" (UID: 00000000-00002816), Spawned process "taskdl.exe" (UID: 00000000-00001436), Spawned process "taskdl.exe" (UID: 00000000-00001080), Spawned process "taskdl.exe" (UID: 00000000-00001924), Spawned process "taskdl.exe" (UID: 00000000-00003516), Spawned process "taskdl.exe" (UID: 00000000-00005892), Spawned process "taskdl.exe" (UID: 00000000-00004964)51:T834,Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGU ..." (UID: 00000000-00000844, Additional Context: "<#icd#>Add-MpPreference <#bth#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#juh#> -Force <#dew#>"), Spawned process "kitty_portable.exe" (UID: 00000000-00004036), Spawned process "AutoClicker-3.1.exe" (UID: 00000000-00004032), Spawned process "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" (UID: 00000000-00004904), Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00002612), Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00003824), Spawned process "Cyber Sniff.exe" (UID: 00000000-00004200), Spawned process "taskdl.exe" (UID: 00000000-00003376), Spawned process "cmd.exe" with commandline "/c 4161747737355.bat" (UID: 00000000-00002852), Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00005776), Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00005968), Spawned process "taskdl.exe" (UID: 00000000-00004408), Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAG4AaABtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGU ..." (UID: 00000000-00003144, Additional Context: "<#nhm#>Add-MpPreference <#pbw#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#rgx#> -Force <#nmx#>"), Spawned process "taskdl.exe" (UID: 00000000-00000708), Spawned process "taskdl.exe" (UID: 00000000-00003632), Spawned process "taskdl.exe" (UID: 00000000-00003804), Spawned process "taskdl.exe" (UID: 00000000-00002804), Spawned process "taskdl.exe" (UID: 00000000-00000608), Spawned process "taskdl.exe" (UID: 00000000-00002816), Spawned process "taskdl.exe" (UID: 00000000-00001436), Spawned process "taskdl.exe" (UID: 00000000-00001080), Spawned process "taskdl.exe" (UID: 00000000-00001924), Spawned process "taskdl.exe" (UID: 00000000-00003516), Spawned process "taskdl.exe" (UID: 00000000-00005892), Spawned process "taskdl.exe" (UID: 00000000-00004964)52:T6bc,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp")53:T2169,"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%APPDATA%\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe]- [targetUID: 00000000-00005888] "AutoClicker-3.1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%APPDATA%\AutoClicker-3.1.exe]- [targetUID: 00000000-00005888] "kitty_portable.exe" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows UPX compressed 3 sections"- Location: [%APPDATA%\kitty_portable.exe]- [targetUID: 00000000-00005888] "WindowsUpdateDaemon.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%APPDATA%\WindowsUpdateDaemon.exe]- [targetUID: 00000000-00004200] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [C:\@WanaDecryptor@.exe]- [targetUID: 00000000-00004904] "CyberSniff.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- Location: [%APPDATA%\CyberSniff.exe]- [targetUID: 00000000-00004200] "taskdl.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%APPDATA%\taskdl.exe]- [targetUID: 00000000-00004904] "taskse.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%APPDATA%\taskse.exe]- [targetUID: 00000000-00004904] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Unicoded MachineID 08d97ndrf7 KnownFolderID 3EB685DB-65F9-4CF6-A03A-E3EF65729F3D Archive NeedIndexed ctime=Tue May 20 10:35:55 2025 atime=Tue May 20 10:35:55 2025 mtime=Fri May 12 00:22:56 2017 length=245760 window=normal IDListSize 0x0209 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Users\""- Location: [%APPDATA%\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00004904] "4161747737355.bat" has type "DOS batch file ASCII text with CRLF CR line terminators"- Location: [%APPDATA%\4161747737355.bat]- [targetUID: 00000000-00004904] "00000000.pky" has type "b.out overlay pure object file V3.0 86 Large Text"- Location: [%APPDATA%\00000000.pky]- [targetUID: 00000000-00004904] "m.vbs" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\m.vbs]- [targetUID: 00000000-00002852] "s.wnry" has type "Zip archive data at least v1.0 to extract compression method=store"- Location: [%APPDATA%\s.wnry]- [targetUID: 00000000-00004904] "xdjnwcf" has type "ASCII text with very long lines (65536) with no line terminators"- Location: [%TEMP%\xdjnwcf]- [targetUID: 00000000-00004032] "m_vietnamese.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_vietnamese.wnry]- [targetUID: 00000000-00004904] "m_korean.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_korean.wnry]- [targetUID: 00000000-00004904] "m_japanese.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_japanese.wnry]- [targetUID: 00000000-00004904] "m_chinese _traditional_.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- [targetUID: N/A] "m_chinese _simplified_.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- [targetUID: N/A] "m_romanian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_romanian.wnry]- [targetUID: 00000000-00004904] "m_greek.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_greek.wnry]- [targetUID: 00000000-00004904] "m_bulgarian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_bulgarian.wnry]- [targetUID: 00000000-00004904] "m_russian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_russian.wnry]- [targetUID: 00000000-00004904] "m_turkish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_turkish.wnry]- [targetUID: 00000000-00004904] "m_slovak.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_slovak.wnry]- [targetUID: 00000000-00004904] "m_latvian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_latvian.wnry]- [targetUID: 00000000-00004904] "m_czech.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_czech.wnry]- [targetUID: 00000000-00004904] "m_polish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_polish.wnry]- [targetUID: 00000000-00004904] "m_croatian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_croatian.wnry]- [targetUID: 00000000-00004904] "m_swedish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_swedish.wnry]- [targetUID: 00000000-00004904] "m_french.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_french.wnry]- [targetUID: 00000000-00004904] "m_finnish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_finnish.wnry]- [targetUID: 00000000-00004904] "m_portuguese.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_portuguese.wnry]- [targetUID: 00000000-00004904] "m_filipino.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_filipino.wnry]- [targetUID: 00000000-00004904] "m_norwegian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_norwegian.wnry]- [targetUID: 00000000-00004904] "m_spanish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_spanish.wnry]- [targetUID: 00000000-00004904] "m_indonesian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_indonesian.wnry]- [targetUID: 00000000-00004904] "m_german.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_german.wnry]- [targetUID: 00000000-00004904] "m_danish.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_danish.wnry]- [targetUID: 00000000-00004904] "m_dutch.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_dutch.wnry]- [targetUID: 00000000-00004904] "m_english.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_english.wnry]- [targetUID: 00000000-00004904] "m_italian.wnry" has type "Rich Text Format data version 1 ANSI code page 1252 default middle east language ID 1025"- Location: [%APPDATA%\msg\m_italian.wnry]- [targetUID: 00000000-00004904] "Default%20Settings" has type "ASCII text with very long lines (452)"- Location: [%APPDATA%\Sessions\Default%20Settings]- [targetUID: 00000000-00004036] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%USERPROFILE%\Documents\@Please_Read_Me@.txt]- [targetUID: 00000000-00004904] "r.wnry" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\r.wnry]- [targetUID: 00000000-00004904] "f.wnry" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\f.wnry]- [targetUID: 00000000-00004904]54:Tb78,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "")55:T1582,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "")56:T7cd,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" reads file "c:\users\%osuser%\appdata\roaming\kitty_portable.exe" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" reads file "c:\users\%osuser%\appdata\roaming\autoclicker-3.1.exe" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" reads file "c:\users\%osuser%\appdata\roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" reads file "c:\users\%osuser%\appdata\roaming\cyber sniff.exe" "powershell.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\system.management.automation.ni.dll.aux" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psm1" "powershell.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive"57:T8c7,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\FLTLIB.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\CRYPTBASE.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "\Device\KsecDD" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\PROPSYS.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to touch file "C:\Windows\system32\PROPSYS.dll"58:T726,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" touched file "C:\Windows\AppPatch\sysmain.sdb"59:T771,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\FLTLIB.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\PROPSYS.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\apphelp.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\version.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\ntmarta.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Secur32.dll" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\SSPICLI.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\PROPSYS.DLL"5a:Ta66,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe.Local\" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Users\ZGA2Y4g\AppData\Roaming\AutoClicker-3.1.exe:Zone.Identifier" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Users\ZGA2Y4g\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe:Zone.Identifier" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\0849B85E16DA3B4FC89EC373FD9F42DC6CFA61F5592792BF48991F1E8D544D3A.EXE.LOCAL" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\kitty_portable.exe:ZONE.IDENTIFIER" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\AutoClicker-3.1.exe:ZONE.IDENTIFIER" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe:ZONE.IDENTIFIER" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Cyber Sniff.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "powershell.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}" "powershell.exe" trying to access non-existent file "\Device\RasAcd"5b:T556,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" writes file "c:\users\%osuser%\appdata\roaming\kitty_portable.exe" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" writes file "c:\users\%osuser%\appdata\roaming\autoclicker-3.1.exe" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" writes file "c:\users\%osuser%\appdata\roaming\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" writes file "c:\users\%osuser%\appdata\roaming\cyber sniff.exe" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\awaewt0z.03q.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\m0ws331c.wsa.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\moduleanalysiscache" "powershell.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "powershell.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "kitty_portable.exe" writes file "c:\users\%osuser%\appdata\roaming\kitty.ini"5c:Te39,Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00000844-00000C2B-3484620716") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00000844-00000C2B-3485637043") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00000844-00000C2B-3485902719") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00000844-00000C2B-3485902719") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00000844-00000C2B-3485902719") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00000844-00000C2B-3491805356") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00000844-00000C2B-3491805356") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00000844-00000C2B-3492688067") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00000844-00000C2B-3492689460") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00000844-00000C2B-3492779990") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00000844-00000C2B-3492781262") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found reference to API "WSAStartup failed (%d)" (Indicator: "WSAStartup"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp")5d:T924,Heuristic match: "6.\.cm" Heuristic match: "uv.id" Heuristic match: "]r[k.cy" Heuristic match: "j~.as" Heuristic match: "'?{.id" Pattern match: "http://%d/%d/%d" Heuristic match: "ctldl.windowsupdate.com" Pattern match: "www.macromedia.com\*" Pattern match: "www.macromedia.com\bin\*" Pattern match: "www.macromedia.com\bin\airappinstaller\*" Pattern match: "www.toshiba.com\*" Pattern match: "www.google.com^privatebrowsingid=1\*" Pattern match: "https://www.9bis.net/kitty" Pattern match: "www.opautoclicker.com" Heuristic match: ".n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.nf" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Heuristic match: "ftp@example.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=798306" Pattern match: "https://aka.ms/dotnet-core-applaunch" Heuristic match: "graftabl.com" Heuristic match: "graphics.com" Heuristic match: "graphics.pro" Heuristic match: "ksproxy.ax" Heuristic match: "kstvtune.ax" Heuristic match: "kswdmcap.ax" Heuristic match: "loadfix.com" Heuristic match: "msdvbnp.ax" Heuristic match: "c_20105.nl" Heuristic match: "c_20107.nl" Heuristic match: "c_20127.nl" Heuristic match: "c_20269.nl" Heuristic match: "c_20277.nl" Heuristic match: "c_20280.nl" Heuristic match: "c_20285.nl" Heuristic match: "c_20297.nl" Heuristic match: "c_20423.nl" Heuristic match: "format.com" Heuristic match: "g711codc.ax" Heuristic match: "fpb.rs" Heuristic match: "grb.rs" Heuristic match: "ivfsrc.ax" Heuristic match: "kb16.com" Heuristic match: "ir41_32.ax" Heuristic match: "mcap.ax" Heuristic match: "mode.com" Heuristic match: "more.com" Heuristic match: "msnp.ax" Heuristic match: "mpeg2data.ax" Heuristic match: "mpg2splt.ax" Heuristic match: "bdaplgin.ax" Heuristic match: "wstpager.ax" Heuristic match: "command.com" Heuristic match: "vbicodec.ax" Heuristic match: "vbisurf.ax" Heuristic match: "oflc-nz.rs" Heuristic match: "pegi-fi.rs" Heuristic match: "pegi-pt.rs" Heuristic match: "pegibbfc.rs" Heuristic match: "psisrndr.ax" Heuristic match: "tree.com" Heuristic match: "usk.rs" Heuristic match: "vidcap.ax" Heuristic match: "web.rs" Heuristic match: "win.com" Pattern match: "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip" Heuristic match: "nud/.nl"5e:T1377,Found URL "https://www.9bis.net/kitty)," - Source: "00000000-00004032.00000000.284999.00FF0000.00000002.mdmp") Found URL "https://curl.haxx.se/docs/http-cookies.html" - Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found URL "ftp://%s:%s@%s%s" - Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=798306" - Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?6.0.6to" - Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=%c" - Source: "00000000-00004200.00000001.286984.027C0000.00000004.mdmp") Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip" - Source: "00000000-00004904.00000000.285267.01680000.00000004.mdmp") Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip3h,h00000000.res00000000.pky00000000.eky" - Source: "00000000-00004904.00000001.287193.1000C000.00000004.mdmp") Found URL "http://www.mpfr.org" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "http://mpmath.org)" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://docs.python.org/zh-cn/>" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "http://www.example.com" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/python/typed_ast).-" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://www.openssl.org/docs/man1.1.0/ssl/ssl_ctx_set_min_proto_version.html" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://docs.python.org/3/-" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://python.visualstudio.com/cpython-" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://sourceforge.net/p/expat/bugs/537/" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/libexpat/libexpat/issues/115-" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/pypa/setuptools/issues/100>" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/python/performance" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/python/typing:" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/python/pythondotorg/issues/945)c" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/libexpat/libexpat/issues/115what's" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://github.com/python/pythondotorg/issues/945)what's" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "http://www.python.org/" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://www.python.org:" - Source: "00000000-00004904.00000002.289114.02470000.00000004.mdmp") Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky" - Source: "00000000-00004904.00000002.289114.1000C000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopublictimestampingrootr46.crl0" - Source: "00000000-00005888.00000001.285494.032A0000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopublictimestampingrootr46.p7c0" - Source: "00000000-00005888.00000001.285494.032A0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0l-gtv[h_r9rc%59)$j+!cx" - Source: "00000000-00005888.00000001.285494.032A0000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-codesigning-rsa-4096-r1.cer0qj0h00,0*https://www.ssl.com/repository0f0d0bggnzgi,(b on the decryptor window." (Source: @Please_Read_Me@.txt, Indicator: "decrypt your files") "Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named "%s". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window." (Source: r.wnry, Indicator: "decrypt your files") "Ooops, your files have been encrypted!" (Source: 00000000-00004904.00000000.285267.00890000.00000004.mdmp, 00000000-00004904.00000000.285267.01680000.00000004.mdmp, Indicator: "files have been encrypted")7c:T6da,Found string "PING" (Indicator: "ping"; Source: "00000000-00004032.00000001.286920.00482000.00000002.mdmp") Found string "Proxy hostname" (Indicator: "hostname"; Source: "00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp") Found string "%%h: hostname" (Indicator: "hostname"; Source: "00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "Hostname '%s' was found" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; Source: "00000000-00004200.00000001.286984.022B0000.00000004.mdmp")7d:Tcd9,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\awaewt0z.03q.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\m0ws331c.wsa.psm1" for deletion "AutoClicker-3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\xdjnwcf" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Desktop\~SD261.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\~SD272.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\Amazon Downloader Logs\~SD292.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\hancom\~SD448.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\~SD449.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\Default\Desktop\~SDA43.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\Default\Desktop\~SDA44.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Desktop\~SDA54.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\Public\Desktop\~SDA55.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\Default\Documents\~SDA56.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\Default\Documents\~SDA67.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\~SDA68.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\Amazon Downloader Logs\~SDA69.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\hancom\~SDC3E.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\~SDC5E.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\Users\Public\Documents\~SDFD8.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\~SD1150.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\$Recycle.Bin\~SD117F.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\$Recycle.Bin\S-1-5-21-2092356043-4041700817-663127204-1001\~SD1180.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\MSOCache\~SD1181.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\MSOCache\All Users\~SD11B1.tmp" for deletion "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" marked "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\~SD11F1.tmp" for deletion7e:T7a3,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\awaewt0z.03q.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\m0ws331c.wsa.psm1" with delete access "AutoClicker-3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xdjnwcf" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\00000000.res" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "Z:\$RECYCLE\0.WNCRYT" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\TorService\tor\pluggable_transports\bridges_list.obfs4.txt.WNCRYT" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\ZGA2Y4g\Documents\Amazon Downloader Logs\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\ZGA2Y4g\Documents\Outlook Files\Outlook.pst" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\ZGA2Y4g\Documents\Database1.accdb" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\%OSUSER%\Documents\Amazon Downloader Logs\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" with delete access "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" opened "C:\Users\%OSUSER%\Documents\Database1.accdb" with delete access7f:T78d,ShellExecuteA RegCloseKey CreateServiceA RegCreateKeyW StartServiceA GetFileAttributesA GetTempPathW CopyFileA CreateDirectoryW Sleep LoadLibraryA WriteFile GetProcAddress TerminateProcess VirtualProtect GetComputerNameW GetStartupInfoA CreateFileA CreateProcessA CreateDirectoryA GetModuleHandleA FindResourceA LockResource GetFileSize GetModuleFileNameA GetFileAttributesW GetFileSizeEx VirtualAlloc RegOpenKeyExW RegDeleteValueW SetSecurityDescriptorDacl RegDeleteKeyW CreateProcessAsUserW GetUserNameW CreateProcessWithLogonW RegEnumKeyExW RegCreateKeyExW OpenProcessToken GetModuleHandleW VirtualAllocEx OpenProcess Process32FirstW CreateThread DeviceIoControl GetModuleFileNameW GetTickCount FindNextFileW FindFirstFileW ExitThread CopyFileW Process32NextW GetVersionExW ReadProcessMemory CreateFileW CreateProcessW LoadLibraryExW WriteProcessMemory GetStartupInfoW GetCommandLineW DeleteFileW IsDebuggerPresent LoadLibraryW FindResourceW GetSystemDirectoryW CreateToolhelp32Snapshot GetSystemInfo GetTempFileNameW GetDriveTypeW OutputDebugStringW UnhandledExceptionFilter EnumProcesses ShellExecuteW ShellExecuteExW GetCursorPos FindWindowW GetWindowThreadProcessId SetKeyboardState GetClipboardData FindWindowExW FtpGetFileSize InternetCloseHandle InternetQueryDataAvailable InternetOpenW HttpQueryInfoW InternetQueryOptionW InternetOpenUrlW InternetReadFile InternetConnectW HttpSendRequestW InternetCrackUrlW FtpOpenFileW connect recvfrom bind accept WSAStartup listen closesocket recv sendto send socket CryptEncrypt GetUserNameA SleepEx SleepConditionVariableSRW VirtualProtectEx CreateRemoteThread GetSystemDirectoryA GetComputerNameA FindFirstFileA GetTempFileNameA GetLogicalDrives FindNextFileA DeleteFileA ShellExecuteExA URLDownloadToFileA GetFileAttributesExW FindFirstFileExW GetModuleHandleExW80:T496,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "ShellExecuteA" with parameter powershell (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "ShellExecuteA" with parameter %APPDATA%\kitty_portable.exe (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "ShellExecuteA" with parameter %APPDATA%\AutoClicker-3.1.exe (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "ShellExecuteA" with parameter %APPDATA%\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (UID: 00000000-00005888) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" called "ShellExecuteA" with parameter %APPDATA%\Cyber Sniff.exe (UID: 00000000-00005888) "Cyber Sniff.exe" called "ShellExecuteA" with parameter %APPDATA%\WindowsUpdateDaemon.exe (UID: 00000000-00004200) "Cyber Sniff.exe" called "ShellExecuteA" with parameter %APPDATA%\PACKED.exe (UID: 00000000-00004200) "Cyber Sniff.exe" called "ShellExecuteA" with parameter %APPDATA%\CyberSniff.exe (UID: 00000000-00004200)81:T1162,"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 564) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 564) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 564) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\kitty_portable.exe" (Handle: 568) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\kitty_portable.exe" (Handle: 568) "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\kitty_portable.exe" (Handle: 568) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 8) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 8) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 8) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 8) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 8) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Windows\System32\icacls.exe" (Handle: 8) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 276) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 276) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 276) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 336) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 336) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 336) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 324) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 324) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 324) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 324) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 324) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 324) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 320) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 320) "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\taskdl.exe" (Handle: 320)82:T402,YARA signature "WannCry_BAT" classified process "00000000-00004904" as "ransomware,wcry,wannacry,wanacrypt0r" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth) YARA signature "WannaDecryptor" classified process "00000000-00004904" as "ransomware,wcry,wannacry,wanacrypt0r" YARA signature "WanaCrypt0r" classified process "00000000-00004904" as "ransomware,wcry,wannacry,wanacrypt0r" (Author: Leo Fernandes - iDefense) YARA signature "WannaDecryptor" classified file "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" as "ransomware,wcry,wannacry,wanacrypt0r" YARA signature "WannaCry_RansomwareEx" classified file "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" as "ransomware,wcry,wannacry,wanacrypt0r" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth (with the help of binar.ly)) YARA signature "win_wannacryptor_g0" classified file "@WanaDecryptor@.exe" as "ransomware,wcry,wannacry,wanacrypt0r" (Author: Daniel Plohmann fkie.fraunhofer.de>)83:T1c30,"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Blue_Gradient.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Garden.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\GreenBubbles.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\HandPrints.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Monet.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Notebook.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\OrangeCircles.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Peacock.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Pine_Lumber.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Psychedelic.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Roses.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Sand_Paper.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\ShadesOfBlue.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Small_News.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\SoftBlue.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Stars.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\Tanspecks.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 8 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg" "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" read 1048576 bytes from file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows Mail\Stationery\White_Chocolate.jpg"84:Tdf8,Spawned process "0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe" (UID: 00000000-00005888) Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAdABoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAdQBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZQB3ACMAPgA="" (UID: 00000000-00000844) Spawned process "kitty_portable.exe" (UID: 00000000-00004036) Spawned process "AutoClicker-3.1.exe" (UID: 00000000-00004032) Spawned process "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe" (UID: 00000000-00004904) Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00002612) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00003824) Spawned process "Cyber Sniff.exe" (UID: 00000000-00004200) Spawned process "taskdl.exe" (UID: 00000000-00003376) Spawned process "cmd.exe" with commandline "/c 4161747737355.bat" (UID: 00000000-00002852) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00005776) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00005968) Spawned process "taskdl.exe" (UID: 00000000-00004408) Spawned process "powershell.exe" with commandline "-EncodedCommand "PAAjAG4AaABtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAYgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAZwB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AbQB4ACMAPgA="" (UID: 00000000-00003144) Spawned process "taskdl.exe" (UID: 00000000-00000708) Spawned process "taskdl.exe" (UID: 00000000-00003632) Spawned process "taskdl.exe" (UID: 00000000-00003804) Spawned process "taskdl.exe" (UID: 00000000-00002804) Spawned process "taskdl.exe" (UID: 00000000-00000608) Spawned process "taskdl.exe" (UID: 00000000-00002816) Spawned process "taskdl.exe" (UID: 00000000-00001436) Spawned process "taskdl.exe" (UID: 00000000-00001080) Spawned process "taskdl.exe" (UID: 00000000-00001924) Spawned process "taskdl.exe" (UID: 00000000-00003516) Spawned process "taskdl.exe" (UID: 00000000-00005892) Spawned process "taskdl.exe" (UID: 00000000-00004964) Spawned process "taskdl.exe" (UID: 00000000-00001624) Spawned process "taskdl.exe" (UID: 00000000-00002388) Spawned process "taskdl.exe" (UID: 00000000-00003088) Spawned process "taskdl.exe" (UID: 00000000-00002892) Spawned process "taskdl.exe" (UID: 00000000-00006116) Spawned process "taskdl.exe" (UID: 00000000-00003552) Spawned process "taskdl.exe" (UID: 00000000-00004316) Spawned process "taskdl.exe" (UID: 00000000-00004820) Spawned process "taskdl.exe" (UID: 00000000-00005208) Spawned process "taskdl.exe" (UID: 00000000-00005104) Spawned process "taskdl.exe" (UID: 00000000-00001000) Spawned process "taskdl.exe" (UID: 00000000-00005068) Spawned process "taskdl.exe" (UID: 00000000-00005632) Spawned process "taskdl.exe" (UID: 00000000-00005576) Spawned process "taskdl.exe" (UID: 00000000-00004972) Spawned process "taskdl.exe" (UID: 00000000-00005380) Spawned process "taskdl.exe" (UID: 00000000-00005464) Spawned process "taskdl.exe" (UID: 00000000-00003988) Spawned process "taskdl.exe" (UID: 00000000-00003036) Spawned process "taskdl.exe" (UID: 00000000-00005804) Spawned process "taskdl.exe" (UID: 00000000-00003308)85:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791326397051,"unified_at":"2026-10-06T22:39:57.051Z","metadata":{"hashes":{"sha256":"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a","sha1":"041e55bf6872fab5589f1262918cb2a3609a1838","md5":"80db6fcf8a589124f620ec27b3b7fb7b","sha512":"86ed5a8be7b05d73101dd5d0e9ba1da49caf9ebc55ddcf3fb4a38fb7855169211403dfa00d27a180a7229b51692f3f1f7967b05e382d741a4146de5b637cf1c0","ssdeep":"393216:fCnSigft7o+XsyZKHHRVs50bie1wnb4wCRYr7GNGu:fC+f5zcTHxVpbiCsAs7g","ssdeep_chunks":["393216:fCnSigf","393216:CnSigft","393216:nSigft7","393216:Sigft7o","393216:igft7o+","393216:gft7o+X","393216:ft7o+Xs","393216:t7o+Xsy","393216:7o+XsyZ","393216:o+XsyZK","393216:+XsyZKH","393216:XsyZKHH","393216:syZKHHR","393216:yZKHHRV","393216:ZKHHRVs","393216:KHHRVs5","393216:HHRVs50","393216:HRVs50b","393216:RVs50bi","393216:Vs50bie","393216:s50bie1","393216:50bie1w","393216:0bie1wn","393216:bie1wnb","393216:ie1wnb4","393216:e1wnb4w","393216:1wnb4wC","393216:wnb4wCR","393216:nb4wCRY","393216:b4wCRYr","393216:4wCRYr7","393216:wCRYr7G","393216:CRYr7GN","393216:RYr7GNG","393216:Yr7GNGu","786432:fCnSigf","786432:CnSigft","786432:nSigft7","786432:Sigft7o","786432:igft7o+","786432:gft7o+X","786432:ft7o+Xs","786432:t7o+Xsy","786432:7o+XsyZ","786432:o+XsyZK","786432:+XsyZKH","786432:XsyZKHH","786432:syZKHHR","786432:yZKHHRV","786432:ZKHHRVs","786432:KHHRVs5","786432:HHRVs50","786432:HRVs50b","786432:RVs50bi","786432:Vs50bie","786432:s50bie1","786432:50bie1w","786432:0bie1wn","786432:bie1wnb","786432:ie1wnb4","786432:e1wnb4w","786432:1wnb4wC","786432:wnb4wCR","786432:nb4wCRY","786432:b4wCRYr","786432:4wCRYr7","786432:wCRYr7G","786432:CRYr7GN","786432:RYr7GNG","786432:Yr7GNGu","393216:fC+f5zc","393216:C+f5zcT","393216:+f5zcTH","393216:f5zcTHx","393216:5zcTHxV","393216:zcTHxVp","393216:cTHxVpb","393216:THxVpbi","393216:HxVpbiC","393216:xVpbiCs","393216:VpbiCsA","393216:pbiCsAs","393216:biCsAs7","393216:iCsAs7g"],"imphash":"6f462fcc6b830b77fb3fef2add9dc570"},"file_info":{"file_name":"cooker.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":17736192,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1747605929000,"last_seen":1765534288000,"last_multi_scan":1765534288000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["wanacrypt0r","wannacry","wcry","ransomware","windows-server-utility"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":107},"sandbox_signatures":{"informative_count":253,"suspicious_count":18,"malicious_count":13,"total":284},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Dropper]/Win32.Dapato","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.FCA.5510","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDropper.Agent.SRP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Agent.tu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a7a3c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Miner.kxjoyo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Drop-DND","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXTF-YQ!80DB6FCF8A58","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Lazy.U.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.XZA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Nitol","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_53.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Agent.Win32.642388","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"},{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"suspicious","value":"Found system commands related strings"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Attempts to read Outlook-related files (file access)"},{"type":"malicious","value":"Reads mail related files"},{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"},{"type":"informative","value":"Attempts to write Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to transfer files using SCP"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HMAC\"; File: \"Default%20Settings\")\n Found reference to \"Miscomputes SSH-2 HMAC keys\" (Indicator: \"HMAC\"; Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")\n Found reference to \"gHMAC2\" (Indicator: \"HMAC\"; Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")\n Found reference to \"CALG_RC2\" (Indicator: \"RC2\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to \"CALG_HMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004904.00000000.285267.10000000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004904.00000001.287193.001EC000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004904.00000002.289114.001E8000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005888.00000000.284320.014F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005888.00000001.285494.014F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005888.00000001.285494.032A0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133922108851382578.844.DefaultAppDomain.powershell; Source: \"00000000-00000844-00000C57-3460021471\")\n Found string - \\\\.\\pipe\\PSHost.133922120514139083.3144.DefaultAppDomain.powershell; Source: \"00000000-00003144-00000C57-3503513592\")\n Found string - ((ht|f)tp(s?):\\/\\/[0-9a-zA-Z]([-\\.\\w]*[0-9a-zA-Z])*([:][0-9]+)?\\/?([-a-zA-Z0-9\\.\\?\\,\\'\\/\\\\\\+=&%\\$#_]*))|(mailto:[a-zA-Z0-9\\-_\\.]+@[a-zA-Z0-9\\-_\\.]+\\.[a-z]{2,})|(ssh:\\/\\/([-a-zA-Z0-9_]+([:][^@]*)?@)?[-a-zA-Z0-9_\\.]+((:[0-9]{2,5})?(\\/[-a-zA-Z0-9_]+)?)?); Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")\n Found string - p(s?):\\/\\/[0-9a-zA-Z]([-\\.\\w]*[0-9a-zA-Z])*([:][0-9]+)?\\/?([-a-zA-Z0-9\\.\\?\\,\\'\\/\\\\\\+=&%\\$#_]*))|(mailto:[a-zA-Z0-9\\-_\\.]+@[a-zA-Z0-9\\-_\\.]+\\.[a-z]{2,})|(ssh:\\/\\/([-a-zA-Z0-9_]+([:][^@]*)?@)?[-a-zA-Z0-9_\\.]+((*0; Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"Cyber Sniff.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2a","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor esi\n 08000000h in Stream UID: 00000000-00004032-26252-1317-00459384","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.0040F000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Commandline contains long base64 encoded string\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"findstr.exe\" (Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000844-00000C2B-3457582574\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000844-00000C2B-3459432273\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004036-00000C2B-3460613214\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000844-00000C2B-3492122750\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"driverquery.exe\" (Indicator: \"driverquery\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005888)\n \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005888)\n \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005888)\n \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005888)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005888)\n \"kitty_portable.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004036)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"IsWow64Process\" with parameter \"5888\" - (UID: 00000000-00005888)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"844\" - (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00000844)\n \"AutoClicker-3.1.exe\" called \"EnumWindows\" with parameter \"4882680\" - (UID: 00000000-00004032)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2f","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005888)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000844)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"kitty_portable.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004036)\n \"AutoClicker-3.1.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004032)\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" called \"OpenMutexA\" with parameter \"Global\\MsWinZonesCacheCounterMutexW\" - (UID: 00000000-00004904)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name ZGA2Y4g (UID: 00000000-00000844)\n \"cscript.exe\" called \"LookupAccountSidW\" with param Name ZGA2Y4g (UID: 00000000-00005776)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name ZGA2Y4g (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000844)\n \"kitty_portable.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004036)\n \"AutoClicker-3.1.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004032)\n \"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005776)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005776)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: WindowsUpdateDaemon.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: AutoClicker-3.1.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$33","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET ow = WScript.CreateObject(\"WScript.Shell\")SET om = ow.CreateShortcut(\"C:\\Users\\ZGA2Y4g\\AppData\\Roaming\\@WanaDecryptor@.exe.lnk\")om.TargetPath = \"C:\\Users\\ZGA2Y4g\\AppData\\Roaming\\@WanaDecryptor@.exe\"om.Save\" (Indicator: \"set \"; File: \"m.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"AutoClicker-3.1.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"AutoClicker-3.1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"kitty_portable.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AutoClicker-3.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Cyber Sniff.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"kitty_portable.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$39","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" has section name .rdata with entropy \"7.997389758410717\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" tries to access a file \"C:\\Users\\ZGA2Y4g\\Documents\\Outlook Files\\Outlook.pst\"\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Attempts to write Outlook-related files (file access)","description":"\"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" writes file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-158","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$3c","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3d","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select a colour from the list, and then click the Modify button to change its appearance.\" (Source: 00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp, Indicator: \"select a colour from the list, and then click the modify button to change its appearance.\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoClicker-3.1.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: kitty_portable.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: WindowsUpdateDaemon.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: @WanaDecryptor@.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: CyberSniff.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: taskse.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c reg add %s /v \"%s\" /t REG_SZ /d \"\\\"%s\\\"\" /f\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\")\n Found string \"cmd.exe /c start /b %s vs\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\")\n Found string \"cmd.exe /c \"%s\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00004904.00000000.285267.0040F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$48","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\MsWinZonesCacheCounterMutexA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MsWinZonesCacheCounterMutexA0\"\n \"Global\\MsWinZonesCacheCounterMutexA0\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c 4161747737355.bat\" (UID: 00000000-00002852)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$4a","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"WindowsUpdateDaemon.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"CyberSniff.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133922108851382578.844.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133922120514139083.3144.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\".ost\" (Indicator: \".ost\") in Source: 00000000-00004904.00000000.285267.00180000.00000004.mdmp\n 00000000-00004904.00000000.285267.10000000.00000004.mdmp\n 00000000-00004904.00000001.287193.001EC000.00000004.mdmp\n 00000000-00004904.00000001.287193.1000C000.00000004.mdmp\n 00000000-00004904.00000002.289114.001E8000.00000004.mdmp\n 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\n \".pst\" (Indicator: \".pst\") in Source: 00000000-00004904.00000000.285267.00180000.00000004.mdmp\n 00000000-00004904.00000000.285267.10000000.00000004.mdmp\n 00000000-00004904.00000001.287193.001EC000.00000004.mdmp\n 00000000-00004904.00000001.287193.1000C000.00000004.mdmp\n 00000000-00004904.00000002.289114.001E8000.00000004.mdmp\n 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\n \"?\\C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \".pst\") in Source: 00000000-00004904.00000001.287193.00180000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00005776)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 64290000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74FF0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74BB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68F10000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 696C0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"kitty_portable.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"AutoClicker-3.1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"attrib.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"icacls.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"Cyber Sniff.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"taskdl.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000\n \"cscript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"cscript.exe\" called \"WScript.Shell.1.Unnamed\" ... \n \"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\Users\\ZGA2Y4g\\AppData\\Roaming\\@WanaDecryptor@.exe.lnk\" ...\n \"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001600c03e676b@ADVAPI32.dll\"\n \"0e000f00703f676b@ADVAPI32.dll\"\n \"0e000f00cc3f676b@ADVAPI32.dll\"\n \"11001200b447676b@ADVAPI32.dll\"\n \"110012004848676b@ADVAPI32.dll\"\n \"120013008c48676b@ADVAPI32.dll\"\n \"12001300e448676b@ADVAPI32.dll\"\n \"140015000c70676b@ADVAPI32.dll\"\n \"140015002470676b@ADVAPI32.dll\"\n \"140015003c70676b@ADVAPI32.dll\"\n \"170018005470676b@ADVAPI32.dll\"\n \"0d000e006c70676b@ADVAPI32.dll\"\n \"110012007c70676b@ADVAPI32.dll\"\n \"110012009070676b@ADVAPI32.dll\"\n \"0d000e003449676b@shell32.dll\"\n \"0d000e00b049676b@shell32.dll\"\n \"0f001000d071676b@ADVAPI32.dll\"\n \"140015001072676b@ADVAPI32.dll\"\n \"140015002872676b@ADVAPI32.dll\"\n \"0c000d007072676b@ADVAPI32.dll\"\n \"0c000d008072676b@ADVAPI32.dll\"\n \"0e000f009072676b@ADVAPI32.dll\"\n \"0e000f00a072676b@ADVAPI32.dll\"\n \"0b000c00b072676b@ADVAPI32.dll\"\n \"18001900e874676b@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"AutoClicker-3.1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"kitty_portable.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"WindowsUpdateDaemon.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"@WanaDecryptor@.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"CyberSniff.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"taskdl.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"taskse.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"WindowsUpdateDaemon.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"CyberSniff.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" has an executable section named \".text\"\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" has an executable section named \".text\"\n \"AutoClicker-3.1.exe\" has an executable section named \".text\"\n \"kitty_portable.exe\" has an executable section named \"UPX0\"\n \"kitty_portable.exe\" has an executable section named \"UPX1\"\n \"WindowsUpdateDaemon.exe\" has an executable section named \".text\"\n \"@WanaDecryptor@.exe\" has an executable section named \".text\"\n \"CyberSniff.exe\" has an executable section named \".text\"\n \"taskdl.exe\" has an executable section named \".text\"\n \"taskse.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" has an writable section named \".bss\"\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" has an writable section named \".data\"\n \"AutoClicker-3.1.exe\" has an writable section named \".data\"\n \"kitty_portable.exe\" has an writable section named \"UPX0\"\n \"kitty_portable.exe\" has an writable section named \"UPX1\"\n \"kitty_portable.exe\" has an writable section named \".rsrc\"\n \"WindowsUpdateDaemon.exe\" has an writable section named \".data\"\n \"@WanaDecryptor@.exe\" has an writable section named \".data\"\n \"CyberSniff.exe\" has an writable section named \".data\"\n \"taskdl.exe\" has an writable section named \".data\"\n \"taskse.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rdata\" is \"0x10e9200\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x34a000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rdata\" is \"0x10e90f4\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x349fa0\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x182000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"WindowsUpdateDaemon.exe\" has high imagebase \"0x140000000\"\n \"CyberSniff.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005888-00000C46-803]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -EncodedCommand \"PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlA\" [Source: 00000000-00005888-00000C46-803], Observed system executable string:\"Administrator: %WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00004032-00000455-4760950272], Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -EncodedCommand \"PAAjAG4AaABtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlA\" [Source: 00000000-00004200-00000C46-3627470635168]\n Observed system executable string:\"%WINDIR%\\system32\\cscript.exe\" [Source: 00000000-00002852-00000C46-257277649200]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00000844) was launched with new environment variables: \"USERDNSDOMAIN=\"08d97Ndrf7\"\"\n Process \"powershell.exe\" (UID: 00000000-00000844) was launched with modified environment variables: \"Path, NUMBER_OF_PROCESSORS\"\n Process \"kitty_portable.exe\" (UID: 00000000-00004036) was launched with modified environment variables: \"Path\"\n Process \"cscript.exe\" (UID: 00000000-00005776) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"attrib.exe\" (UID: 00000000-00005968) was launched with missing environment variables: \"PROMPT\"\n Process \"powershell.exe\" (UID: 00000000-00003144) was launched with modified environment variables: \"Path\"\n Process \"taskdl.exe\" (UID: 00000000-00000708) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AutoClicker-3.1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"kitty_portable.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"@WanaDecryptor@.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"taskdl.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"taskse.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\awaewt0z.03q.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\m0ws331c.wsa.psm1\"\n \"AutoClicker-3.1.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\xdjnwcf\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\0didrdtj.jt0.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\flg5msi0.t0y.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" connecting to \"\\ThemeApiPort\"\n \"AutoClicker-3.1.exe\" connecting to \"\\ThemeApiPort\"\n \"Cyber Sniff.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00004904.00000000.285267.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$53","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\@WanaDecryptor@.exe.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$5b","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000844)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"55f1b90\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"55f1b90\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;\" (Indicator: \".onion\") in Source: 00000000-00004904.00000000.285267.01680000.00000004.mdmp\n 00000000-00004904.00000001.287193.1000C000.00000004.mdmp\n 00000000-00004904.00000002.289114.1000C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00004200.00000001.286984.022B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"Observed string: \"SCP and WinSCP\" (Indicator: \"scp \") in Source: 00000000-00004036.00000001.286703.007C0000.00000004.mdmp\n 00000000-00004036.00000002.288626.007C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ymx.e\" [Source: 0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe]\n Observed email domain:\"imap.\" [Source: 00000000-00004200.00000001.286984.022B0000.00000004.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00004200.00000001.286984.022B0000.00000004.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00004200.00000001.286984.022B0000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00004904.00000000.285267.00180000.00000004.mdmp]\n Observed email domain:\"midimap.dll\" [Source: 00000000-00004904.00000000.285267.00180000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.255.255.255\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"2.5.29.1\"\n \"2.5.29.31\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n Potential IP \"127.0.0.1\" found in string \"127.0.0.1/\"\n \"2.5.29.17\"\n \"2.5.4.3\"\n \"2.5.4.4\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.12\"\n \"2.5.4.13\"\n \"2.5.4.17\"\n \"2.5.4.41\"\n \"2.5.4.42\"\n \"2.5.4.43\"\n \"2.5.4.44\"\n \"2.5.4.45\"\n \"2.5.4.46\"\n \"2.5.4.65\"\n \"2.5.4.72\"\n \"2.5.29.18\"\n \"2.5.29.19\"\n \"3.2.7.5\"\n \"3.2.6.5\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"Forcing HTTP/1.1 for NTLM\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"HTTP/1.0 proxy connection set to keep alive!\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"HTTP/1.1 proxy connection set close!\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"HTTP/1.0 connection set to keep alive!\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetAddConnection\" which can \"make a connection to a network resource\" [Source: AutoClicker-3.1.exe]\n Observed import api \"WNetCancelConnection\" which can \"cancel an existing network connection\" [Source: AutoClicker-3.1.exe]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: AutoClicker-3.1.exe]\n Observed import api \"WNetUseConnection\" which can \"make a connection to a network resource\" [Source: AutoClicker-3.1.exe]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00004904\"\n YARA signature for AES encryption matched on file \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\"\n YARA signature for AES encryption matched on file \"@WanaDecryptor@.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"WindowsUpdateDaemon.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: AutoClicker-3.1.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"Observed string: \"sftp\" (Indicator: \"sftp\") in Source: 00000000-00004036.00000001.286703.02680000.00000004.mdmp\n 00000000-00004036.00000002.288626.02680000.00000004.mdmp\n Observed string: \"SFTP connect ([user@]hostname[:port])\" (Indicator: \"sftp \") in Source: 00000000-00004036.00000001.286703.02680000.00000004.mdmp\n 00000000-00004036.00000002.288626.02680000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-578","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$60","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"AutoClicker-3.1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Cyber Sniff.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"taskdl.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"$62","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$63","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: AutoClicker-3.1.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00004904.00000000.285267.00180000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp, 00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004200.00000001.286984.027C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004904-00000C2D-1344239767035\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\@Please_Read_Me@.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004904-00000C3C-1637584375451\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\@WanaDecryptor@.exe.lnk\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004904-00000C3C-1637584375520\")\n Found string \"?\\C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00004904.00000001.287193.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Auto-login password\" (Indicator: \"password\"; Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")\n Found string \"Omit known password fields\" (Indicator: \"password\"; Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")\n Found string \"Refuses all SSH-1 password camouflage\" (Indicator: \"password\"; Source: \"00000000-00004036.00000001.286703.02680000.00000004.mdmp, 00000000-00004036.00000002.288626.02680000.00000004.mdmp\")\n Found string \"Excessive password length for proxy auth\" (Indicator: \"password\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"schannel: Failed to import cert file %s, password is bad\" (Indicator: \"password\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%USERPROFILE%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00004904-00000C2D-3002622671339\")\n \"%USERPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00004904-00000C2D-3002622671371\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00004904-00000C2D-4206970637552\")\n \".\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00003824-00000C2D-14585911720400\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000844)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003144)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: AutoClicker-3.1.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004032.00000001.286920.00482000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"DSeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; File: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004200.00000001.286984.022B0000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp, 00000000-00004904.00000000.285267.00408000.00000002.mdmp, 00000000-00004904.00000000.285267.10000000.00000004.mdmp, 00000000-00004904.00000001.287193.001EC000.00000004.mdmp, 00000000-00004904.00000001.287193.1000C000.00000004.mdmp, 00000000-00004904.00000002.289114.001E8000.00000004.mdmp, 00000000-00004904.00000002.289114.10007000.00000002.mdmp, 00000000-00004904.00000002.289114.1000C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$74","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\" opened \"\\Device\\KsecDD\"\n \"kitty_portable.exe\" opened \"\\Device\\KsecDD\"\n \"AutoClicker-3.1.exe\" opened \"\\Device\\KsecDD\"\n \"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" opened \"\\Device\\KsecDD\"\n \"Cyber Sniff.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$75","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"-EncodedCommand \"PAAjAGkAYwBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAdABoACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAdQBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZQB3ACMAPgA=\"\" (UID: 00000000-00000844)\n Process \"powershell.exe\" with commandline \"-EncodedCommand \"PAAjAG4AaABtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAYgB3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAZwB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AbQB4ACMAPgA=\"\" (UID: 00000000-00003144)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"0849b85e16da3b4fc89ec373fd9f42dc6cfa61f5592792bf48991f1e8d544d3a.exe\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00004032.00000001.286920.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,mpnotify.exe,ctfmon.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00004904.00000000.285267.00180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$77","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"AutoClicker-3.1.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"kitty_portable.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"\n \"@WanaDecryptor@.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskdl.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskse.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"kitty_portable.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"AutoClicker-3.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$78","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"682c757d965e8dafe60a4b69"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00000844)\n \"kitty_portable.exe\" called \"FileTimeToLocalFileTime\" with parameter 0fc12bd572c9db01 & 0f91b49883c9db01 (UID: 00000000-00004036)\n \"kitty_portable.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00004036)\n \"kitty_portable.exe\" called \"FileTimeToLocalFileTime\" with parameter d03f74bd266cd301 & d00ffd80376cd301 (UID: 00000000-00004036)\n \"kitty_portable.exe\" called \"FileTimeToLocalFileTime\" with parameter el & e