24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AIT:Trojan.Nymeria Sample 0f0cc7e07e9b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0f0cc7e07e9b…. Malware family: AIT:Trojan.Nymeria. Threat score 100/100. 14/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7","keywords":["Malicious","AIT:Trojan.Nymeria","malware analysis","sandbox report","threat intelligence","0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7"],"about":{"@type":"SoftwareApplication","name":"TT Proof.PDF.exe","applicationCategory":["peexe","autoit","executable"],"identifier":"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"AIT:Trojan.Nymeria","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8ae,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")26:Tafe,Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")27:T602,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")28:T971,Found XOR loop in file "sample.bin" at offset 669615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 743641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 777591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 791108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 866508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 907650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1058255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1072630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1108098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1340221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 304939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 304965; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 305063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 391744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 679929; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 717623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 902241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 909762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 930648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1164381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1220375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1240633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1287854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 271586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 708361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 804511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 808905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 847979; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 893807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 942958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1164249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1275884; code bytes = 803029:T5f4,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")2a:T5a7,Found system information discovery API: "GetUserObjectInformationW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found system information discovery API: "GetNativeSystemInfo" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found system information discovery API: "GetSystemInfo" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found system information discovery API: "GetMonitorInfoW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp"2b:T916,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")2c:T80e,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003e3f080000007d000000e2014a4b4c4d4e4f505152530000000058595a5b85000000606100010000000068696a01b83bac06b83bac060200000078797a7b7d00000080818283c03bac067f0000008c8d8e8f90000193feffffff98999a9b6002ac06a0a1a2a3a4a5a600000000007d000000b0b1b2006002ac067d0000007d0000007d0000007d000000c8c9cacbcccdcecf8cf85f01506a3b77b1fe6fc3feffffffa0f75f01b71638773800000040000000b402ac068cf75f01040000000c31ac060831ac060800000094f75f01666c41000000ac0600000000c03bac067028480000901d01a8f75f010782410060674900e8f75f01aa16410008000000 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004744)2d:T629,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")2e:T84e,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")2f:T5f5,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004744)30:T229f,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004744) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00004744)31:T468,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")32:T844,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74270000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74270000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74270000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "KERNEL32" at base 76870000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72900000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "KERNEL32.DLL" at base 76870000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "UXTHEME.DLL" at base 73810000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73810000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "NTDLL.DLL" at base 77340000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "COMCTL32.DLL" at base 72d00000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "COMCTL32" at base 72d00000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\SYSTEM\ADO\MSADO15.DLL" at base 72790000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "RPCRT4.DLL" at base 74d60000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "USER32.DLL" at base 769e0000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "ADVAPI32.DLL" at base 76510000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "SHELL32.DLL" at base 75100000 "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" loaded module "SHLWAPI.DLL" at base 7644000033:T47a,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")34:T7d3,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")35:Te67,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "0F0CC7E07E9B2C3000EE7F2966241F4A21756770A4B775A151A38219FF3886C7.EXE"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")36:T53c,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\0F0CC7E07E9B2C3000EE7F2966241F4A21756770A4B775A151A38219FF3886C7.EXE.LOCAL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\WSOCK32.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to touch file "C:\Windows\SysWOW64\wsock32.dll"37:Tc15,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\WSOCK32.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\VERSION.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\WINMM.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\MPR.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\WININET.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\USERENV.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\FLTLIB.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\UXTHEME.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\uxtheme.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\CLDAPI.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\CLDAPI.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\AEPIC.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\AEPIC.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\BCRYPT.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\bcrypt.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\DWMAPI.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\dwmapi.dll" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\system\ado\MSDART.DLL" "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" trying to access non-existent file "C:\Program Files (x86)\Common Files\System\ado\MSDART.DLL"38:T4c6,Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")39:T7f0,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")3a:Tf55,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")3b:T5ef,Found registry query API: "RegOpenKeyExW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found registry query API: "RegQueryValueExW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found registry query API: "RegEnumKeyExW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found registry query API: "RegEnumValueW" in file "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" Found registry query API: "RegOpenKeyExA" in "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004744.00000001.299382.00482000.00000002.mdmp"3c:T902,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")3d:T612,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")3e:Td18,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")3f:Tcee,Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")40:T4d0,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")41:Tf64,Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004744.00000001.299382.00482000.00000002.mdmp")42:Te49,Found string "FlsFree" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "frexp" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: UCRTBASE.DLL) Found string "log10" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: UCRTBASE.DLL) Found string "GetProcessWindowStation" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: USER32.DLL) Found string "MessageBoxW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: USER32.DLL) Found string "IsThemeActive" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: UXTHEME.DLL) Found string "IsWow64Process" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "GetNativeSystemInfo" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleExW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "GetSystemWow64DirectoryW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: KERNELBASE.DLL) Found string "RegDeleteKeyExW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: ADVAPI32.DLL) Found string "GetFileVersionInfoSizeW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: VERSION.DLL) Found string "GetFileVersionInfoW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: VERSION.DLL) Found string "VerQueryValueW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: VERSION.DLL) Found string "timeGetTime" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: WINMM.DLL) Found string "mciSendStringW" (Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe, API is part of module: WINMM.DLL)43:T652,"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4896104'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895928'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4896136'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895784'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4896120'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895768'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895944'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4896152'}" (UID: 00000000-00002908) "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4895800'}" (UID: 00000000-00002908)44:T1188,Assembly shows XOR instruction xor eax ebp in Stream UID: 31338-101-0041B0B5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 31338-101-0041B0B5 Assembly shows XOR instruction xor eax 01h in Stream UID: 31338-278-0044CF17 Assembly shows XOR instruction xor edx ecx in Stream UID: 31338-278-0044CF17 Assembly shows XOR instruction xor ecx 01h in Stream UID: 31338-278-0044CF17 Assembly shows XOR instruction xor dword ptr [ebp-34h] eax in Stream UID: 31338-1586-0045FD57 Assembly shows XOR instruction xor eax ebp in Stream UID: 31338-1652-00416EF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 31338-1652-00416EF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 31338-1654-004171A4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 31338-1654-004171A4 Assembly shows XOR instruction xor byte ptr [ebp-000000F0h] al in Stream UID: 31338-2048-004443FC Assembly shows XOR instruction xor byte ptr [ebp-60h] al in Stream UID: 31338-2048-004443FC Assembly shows XOR instruction xor byte ptr [ebp-5Fh] al in Stream UID: 31338-2048-004443FC Assembly shows XOR instruction xor byte ptr [ebp-000000EFh] al in Stream UID: 31338-2048-004443FC Assembly shows XOR instruction xor byte ptr [ebp-000000EEh] al in Stream UID: 31338-2048-004443FC Assembly shows XOR instruction xor byte ptr [ebp-000000A5h] al in Stream UID: 31338-2048-004443FC Assembly shows XOR instruction xor byte ptr [ebp+eax-0000011Ch] 80h in Stream UID: 31338-2167-0044C37A Assembly shows XOR instruction xor ebx 10h in Stream UID: 31338-2184-004505F0 Assembly shows XOR instruction xor eax 00000100h in Stream UID: 31338-2185-004507B7 Assembly shows XOR instruction xor eax 01h in Stream UID: 31338-2201-00451465 Assembly shows XOR instruction xor edi 000087BCh in Stream UID: 31338-2215-00452AC7 Assembly shows XOR instruction xor eax 0000A685h in Stream UID: 31338-2215-00452AC7 Assembly shows XOR instruction xor byte ptr [esp+ecx+000011C8h] al in Stream UID: 31338-2215-00452AC7 Assembly shows XOR instruction xor edi 08000000h in Stream UID: 31338-2306-004590BD Assembly shows XOR instruction xor esi 08000000h in Stream UID: 31338-2310-004594E9 Assembly shows XOR instruction xor dword ptr [esp+10h] 08h in Stream UID: 31338-2545-00467897 Assembly shows XOR instruction xor dword ptr [ebp+20h] eax in Stream UID: 31338-2657-00471BC9 Assembly shows XOR instruction xor eax 00080000h in Stream UID: 31338-2748-0047A26A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-20-00418752 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-20-00418752 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-24-0042009C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-24-0042009C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-29-00417DAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-29-00417DAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-196-0041B0B5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-196-0041B0B5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-424-0041F814 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-424-0041F814 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-434-00425095 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-434-00425095 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002908-33753-439-0041C62B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002908-33753-439-0041C62B Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 00000000-00002908-33753-541-0041C9AE Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 00000000-00002908-33753-541-0041C9AE Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00002908-33753-541-0041C9AE Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00002908-33753-541-0041C9AE Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 00000000-00002908-33753-812-00422400 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 00000000-00002908-33753-812-0042240045:T487,FindNextFileW@KERNEL32.dll at 31338-1787-00431A86 FindNextFileW@KERNEL32.dll at 31338-2008-00442886 FindFirstFileW@KERNEL32.dll at 31338-2161-0044BD27 FindFirstFileW@KERNEL32.dll at 31338-2162-0044BF8B FindFirstFileW@KERNEL32.dll at 31338-2214-00452492 FindFirstFileW@KERNEL32.dll at 31338-2425-0045CAFA FindFirstFileW@KERNEL32.dll at 31338-2442-0045DE8F FindNextFileW@KERNEL32.dll at 31338-2538-00467001 FindFirstFileW@KERNEL32.dll at 31338-2710-004788BD FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-863-004339B6 FindNextFileW@KERNEL32.DLL at 00000000-00002908-33753-1196-00431A86 FindNextFileW@KERNEL32.DLL at 00000000-00002908-33753-1417-00442886 FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-1570-0044BD27 FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-1571-0044BF8B FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-1623-00452492 FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-1834-0045CAFA FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-1851-0045DE8F FindNextFileW@KERNEL32.DLL at 00000000-00002908-33753-1947-00467001 FindFirstFileW@KERNEL32.DLL at 00000000-00002908-33753-2119-004788BD46:T5e2,OpenProcessToken@ADVAPI32.dll at 31338-1817-004333BE OpenProcess@KERNEL32.dll at 31338-1833-00433FCE OpenProcess@KERNEL32.dll at 31338-1840-004343AD GetProcessHeap@KERNEL32.dll at 31338-1939-00436B91 GetProcessHeap@KERNEL32.dll at 31338-1940-00436BA9 GetProcessHeap@KERNEL32.dll at 31338-1944-00436B19 OpenProcessToken@ADVAPI32.dll at 31338-1950-00436E94 OpenProcessToken@ADVAPI32.dll at 31338-1951-00436F47 OpenProcess@KERNEL32.dll at 31338-2284-00457AD9 OpenProcess@KERNEL32.dll at 31338-2510-00464EAE OpenProcess@KERNEL32.dll at 31338-2681-004757A7 OpenProcess@KERNEL32.dll at 31338-2803-0048127D OpenProcess@KERNEL32.DLL at 00000000-00002908-33753-392-00433D9E GetProcessHeap@KERNEL32.DLL at 00000000-00002908-33753-814-004238DA OpenProcessToken@ADVAPI32.DLL at 00000000-00002908-33753-1226-004333BE OpenProcess@KERNEL32.DLL at 00000000-00002908-33753-1242-00433FCE OpenProcess@KERNEL32.DLL at 00000000-00002908-33753-1249-004343AD GetProcessHeap@KERNEL32.DLL at 00000000-00002908-33753-1348-00436B91 GetProcessHeap@KERNEL32.DLL at 00000000-00002908-33753-1349-00436BA9 GetProcessHeap@KERNEL32.DLL at 00000000-00002908-33753-1353-00436B19 OpenProcessToken@ADVAPI32.DLL at 00000000-00002908-33753-1359-00436E94 OpenProcessToken@ADVAPI32.DLL at 00000000-00002908-33753-1360-00436F47 OpenProcess@KERNEL32.DLL at 00000000-00002908-33753-1693-00457AD9 OpenProcess@KERNEL32.DLL at 00000000-00002908-33753-1919-00464EAE OpenProcess@KERNEL32.DLL at 00000000-00002908-33753-2090-004757A747:T4f9,Sleep@KERNEL32.dll at 31338-1559-0040D3B0 SetTimer at 31338-1573-00401250 SetTimer at 31338-1575-00401100 Sleep@KERNEL32.dll at 31338-1586-0045FD57 Sleep@KERNEL32.dll at 31338-1844-00434582 Sleep@KERNEL32.dll at 31338-1937-00436A0B WaitForSingleObject@KERNEL32.dll at 31338-1942-00436C2B Sleep@KERNEL32.dll at 31338-2033-00443B61 WaitForSingleObject@KERNEL32.dll at 31338-2034-00443C87 SetTimer at 31338-2233-00454639 Sleep@KERNEL32.dll at 31338-2540-004671B9 SetTimer at 31338-2657-00471BC9 Sleep@KERNEL32.dll at 31338-2689-00476CA4 Sleep@KERNEL32.dll at 31338-2786-0047D40F Sleep@KERNEL32.DLL at 00000000-00002908-33753-39-00416B04 Sleep@KERNEL32.DLL at 00000000-00002908-33753-43-00416B49 Sleep@KERNEL32.DLL at 00000000-00002908-33753-72-00416B95 Sleep@KERNEL32.DLL at 00000000-00002908-33753-320-0042DFCC Sleep@KERNEL32.DLL at 00000000-00002908-33753-380-0045178A Sleep@KERNEL32.DLL at 00000000-00002908-33753-384-00453BC6 Sleep@KERNEL32.DLL at 00000000-00002908-33753-443-00416BE3 Sleep@KERNEL32.DLL at 00000000-00002908-33753-651-004091B0 WaitForSingleObject@KERNEL32.DLL at 00000000-00002908-33753-659-0044B63B WaitForSingleObject@KERNEL32.DLL at 00000000-00002908-33753-664-004319AC Sleep@KERNEL32.DLL at 00000000-00002908-33753-665-004331A248:T5c8,LoadLibraryA@KERNEL32.dll at 31338-1539-0040EFD0 LoadLibraryA@KERNEL32.dll at 31338-1542-0040EF60 LoadLibraryA@KERNEL32.dll at 31338-1752-00430C7F LoadLibraryA@KERNEL32.dll at 31338-1756-00430E7B LoadLibraryA@KERNEL32.dll at 31338-1762-0043129A LoadLibraryA@KERNEL32.dll at 31338-1763-004312CC LoadLibraryA@KERNEL32.dll at 31338-1764-004312FE LoadLibraryA@KERNEL32.dll at 31338-1855-00434B02 LoadLibraryW@KERNEL32.dll at 31338-1966-00440C49 LoadLibraryExW@KERNEL32.dll at 31338-2242-00454E8D LoadLibraryW@KERNEL32.dll at 31338-2282-0045774C LoadLibraryW@KERNEL32.dll at 31338-2506-00464812 LoadLibraryW@KERNEL32.DLL at 00000000-00002908-33753-24-0042009C LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-478-00430DC1 LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-898-0040EFD0 LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-901-0040EF60 LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-910-0040EBD0 LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-1161-00430C7F LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-1165-00430E7B LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-1171-0043129A LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-1172-004312CC LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-1173-004312FE LoadLibraryA@KERNEL32.DLL at 00000000-00002908-33753-1264-00434B02 LoadLibraryW@KERNEL32.DLL at 00000000-00002908-33753-1375-00440C49 LoadLibraryExW@KERNEL32.DLL at 00000000-00002908-33753-1651-00454E8D49:T4fb,Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "gethostname" (Indicator: "gethostname"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002908.00000000.79717.00E80000.00000002.mdmp")4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAB3d3d3d3cAAAAAAAAAAA93d3d3d3d3dwAAAAAAAAD3d3d3d3d3d3d/AAAAAAD3d3d3iIiIiId3d3AAAAAPd3d3j4h3d4iIh3d3AAAA93d3j4d2Z3ZneIiHd3AAAPd3eIdmZmd3ZmZ4iHd/AA93d4h0ZmZ3d2ZkR4iHdwD3d3iHRGZnd3d2ZkR4iHdw93eIdEZmZ3d3dmZkR4h3cIeHiGRGZmd3d3ZmZEaIh3d3d4cAAAQAAAAAAAAAeIh3eHiHCIdwCId3d4iIgHh4d3h4dECIhwCIiIiIiARIeId4eHRmeIgEd3d3iPdER3iHeHh0ZkeIgHd3B4hwZkd4h3h4dGZwiIcHcHeIB2ZHeId4eHZndwiIBGB49nd2Z3iHeIh2Z3dniIAHiHZ3dmd4h3iId3d3hHiIiIcId3Z4eId3iId3d4gIiIjwiId3eHh3h4iHd3iIh4iId4iHd3eId/eIh3d4iId4h3iIh3d4+HD4eIh3eIiId3eIiId3ePdwD3iIh3eIiP+PiIh3d4+H8A/3iId3eIiIiIh3d3j4fwAA+HiIh3d3iIh3d3ePh3AAAA93j4h3d3d3d3eI+HfwAAAA+Hj/iId3d3iI/4d/AAAAAA/3eP//iIj//4d/8AAAAAAA/4d4iP//+Id38AAAAAAAAAD/93d3d3d4/wAAAAD/wAP//gAA//wAAD/wAAAf4AAAD8AAAAfAAAADgAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAGAAAABgAAAA8AAAAfgAAAH8AAAD/gAAB/8AAB//wAA/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792043981498,"unified_at":"2026-10-15T05:59:41.498Z","metadata":{"hashes":{"sha256":"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7","sha1":"9c98f32f15e61dda0611f8390dcfddc5fc08b5d7","md5":"a2d6418544ae0d08f3a1b0b73928b20a","sha512":"b783f19f9eeb4d38e6c2bfb72c99cb4f46edbd206c3da22ba1bc492fe9b921978cad57d44967638a9c44765f8e94875a56081250fb615abf82d1517f22ea169c","ssdeep":"24576:uRmJkcoQricOIQxiZY1iaCuQ06dFF7AI4x+cj0gPQ3BuhrzEIz:7JZoQrbTFZY1iaCuQ06dj34x+T3khrgC","ssdeep_chunks":["24576:uRmJkco","24576:RmJkcoQ","24576:mJkcoQr","24576:JkcoQri","24576:kcoQric","24576:coQricO","24576:oQricOI","24576:QricOIQ","24576:ricOIQx","24576:icOIQxi","24576:cOIQxiZ","24576:OIQxiZY","24576:IQxiZY1","24576:QxiZY1i","24576:xiZY1ia","24576:iZY1iaC","24576:ZY1iaCu","24576:Y1iaCuQ","24576:1iaCuQ0","24576:iaCuQ06","24576:aCuQ06d","24576:CuQ06dF","24576:uQ06dFF","24576:Q06dFF7","24576:06dFF7A","24576:6dFF7AI","24576:dFF7AI4","24576:FF7AI4x","24576:F7AI4x+","24576:7AI4x+c","24576:AI4x+cj","24576:I4x+cj0","24576:4x+cj0g","24576:x+cj0gP","24576:+cj0gPQ","24576:cj0gPQ3","24576:j0gPQ3B","24576:0gPQ3Bu","24576:gPQ3Buh","24576:PQ3Buhr","24576:Q3Buhrz","24576:3BuhrzE","24576:BuhrzEI","24576:uhrzEIz","49152:uRmJkco","49152:RmJkcoQ","49152:mJkcoQr","49152:JkcoQri","49152:kcoQric","49152:coQricO","49152:oQricOI","49152:QricOIQ","49152:ricOIQx","49152:icOIQxi","49152:cOIQxiZ","49152:OIQxiZY","49152:IQxiZY1","49152:QxiZY1i","49152:xiZY1ia","49152:iZY1iaC","49152:ZY1iaCu","49152:Y1iaCuQ","49152:1iaCuQ0","49152:iaCuQ06","49152:aCuQ06d","49152:CuQ06dF","49152:uQ06dFF","49152:Q06dFF7","49152:06dFF7A","49152:6dFF7AI","49152:dFF7AI4","49152:FF7AI4x","49152:F7AI4x+","49152:7AI4x+c","49152:AI4x+cj","49152:I4x+cj0","49152:4x+cj0g","49152:x+cj0gP","49152:+cj0gPQ","49152:cj0gPQ3","49152:j0gPQ3B","49152:0gPQ3Bu","49152:gPQ3Buh","49152:PQ3Buhr","49152:Q3Buhrz","49152:3BuhrzE","49152:BuhrzEI","49152:uhrzEIz","24576:7JZoQrb","24576:JZoQrbT","24576:ZoQrbTF","24576:oQrbTFZ","24576:QrbTFZY","24576:rbTFZY1","24576:bTFZY1i","24576:TFZY1ia","24576:FZY1iaC","24576:CuQ06dj","24576:uQ06dj3","24576:Q06dj34","24576:06dj34x","24576:6dj34x+","24576:dj34x+T","24576:j34x+T3","24576:34x+T3k","24576:4x+T3kh","24576:x+T3khr","24576:+T3khrg","24576:T3khrgC"],"imphash":"a46a46b6741b96758ff5cf06d0c4c13c"},"file_info":{"file_name":"TT Proof.PDF.exe","file_type":["peexe","autoit","executable"],"file_type_id":"autoit","file_size":1353363,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1727019318000,"last_seen":1786482899000,"last_multi_scan":1786482899000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["pistolar","autoit","evasive"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":85},"sandbox_signatures":{"informative_count":202,"suspicious_count":13,"malicious_count":6,"total":221},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.6337","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.6337 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Formbook.AK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000111 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/AuItInj-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W32/Formbook.s","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/AutoIt.AQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.AutoIt.HHI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Strab.Win32.9749","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"AIT:Trojan.Nymeria","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"},{"type":"informative","value":"Contains ability to register hotkeys"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"},{"type":"suspicious","value":"Attempts to gain higher privileges by abusing weaknesses"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Queries kernel debugger information"},{"type":"informative","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"suspicious","value":"Contains ability to block user input"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"suspicious","value":"Contains ability to empty the Recycle Bin on the specified drive"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains references to RC4 cryptographic API (string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Attempts to spawn svchost.exe with command line containing unauthorized parent reference"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"},{"type":"suspicious","value":"Contains ability to simulate user keyboard/mouse input"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"},{"type":"suspicious","value":"Able to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004744.00000000.299312.03830000.00000004.mdmp, 00000000-00004744.00000001.299382.03830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004744.00000001.299382.06AD0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" queried SystemProcessInformation at 00000000-00004744-00000C15-3612409584 [PID: 4744]\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" queried SystemProcessInformation at 00000000-00004744-00000C15-3612418035 [PID: 4744]\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" queried SystemProcessInformation at 00000000-00004744-00000C15-3615314526 [PID: 4744]\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" queried SystemProcessInformation at 00000000-00004744-00000C15-3615321978 [PID: 4744]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004744.00000001.299382.03830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00004744.00000001.299382.03830000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004744.00000001.299382.03830000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.53717","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004744)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004744)\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004744)\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004744)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004744)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"IsWow64Process\" with parameter \"4744\" - (UID: 00000000-00004744)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004744)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cd door\" (Indicator: \"set \"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"CreateProcessW\" with parameter \"\"C:\\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\"\" - (UID: 00000000-00004744)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"select * from\" (Source: 00000000-00004744.00000001.299382.72791000.00000020.mdmp, Indicator: \"select * from\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004744.00000000.299312.06870000.00000002.mdmp, 00000000-00004744.00000001.299382.00482000.00000002.mdmp, 00000000-00004744.00000001.299382.72875000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\AutoIt v3\\AutoIt\" in Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\n \"SOFTWARE\\Classes\\\" in Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004744.00000000.299312.03830000.00000004.mdmp\n 00000000-00004744.00000001.299382.03830000.00000004.mdmp\n \"Software\\AutoIt v3\\AutoIt\" in Source: 00000000-00004744.00000001.299382.00482000.00000002.mdmp\n \"SOFTWARE\\Classes\\\" in Source: 00000000-00004744.00000001.299382.00482000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: 00000000-00004744.00000001.299382.00482000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\BidInterface\\Loader\" in Source: 00000000-00004744.00000001.299382.72791000.00000020.mdmp\n \"*** [HKLM\\\" in Source: 00000000-00004744.00000001.299382.72791000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4744:168:WilStaging_02\"\n Process 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4744:64:WilError_01\"\n Process 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe created mutex with name \"Local\\SM0:4744:168:WilStaging_02\"\n Process 0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe created mutex with name \"SM0:4744:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"avsupport@autoitscript.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004744.00000000.299312.03830000.00000004.mdmp\n \"Software\\AutoIt v3\\AutoIt\" in Source: 00000000-00004744.00000001.299382.00482000.00000002.mdmp\n \"SOFTWARE\\Classes\\\" in Source: 00000000-00004744.00000001.299382.00482000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: 00000000-00004744.00000001.299382.00482000.00000002.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004744.00000001.299382.03830000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\BidInterface\\Loader\" in Source: 00000000-00004744.00000001.299382.72791000.00000020.mdmp\n \"*** [HKLM\\\" in Source: 00000000-00004744.00000001.299382.72791000.00000020.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74D00000\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 730E0000\n \"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74D00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74D60000\n \"svchost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74D60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"ADODB.Stream.6.0.Type\" ... \n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"ADODB.Stream.6.0.Open\" ... \n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"ADODB.Stream.6.0.Write\" ... \n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"ADODB.Stream.6.0.SaveToFile\" ... \n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" called \"ADODB.Stream.6.0.Close\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" was detected as \"AutoIt\" and name: \"Library\"\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" touched \"ADODB.Stream\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00000566-0000-0010-8000-00AA006D2EA4}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\svchost.exe\" [Source: 00000000-00004744-00000BC0-3615738640]\n Observed system executable string:\"%WINDIR%\\System32\\svchost.exe\" [Source: 00000000-00004744-00000C47-8710508826]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"svchost.exe\" (UID: 00000000-00004540) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"svchost.exe\" (UID: 00000000-00004540) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"svchost.exe\" with commandline \"\"C:\\\\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3 ...\" (UID: 00000000-00004540)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"svchost.exe\" with commandline \"\"C:\\\\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3 ...\" (UID: 00000000-00004540)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1223383)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\reindulging\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"reindulging\" has type \"data\"- Location: [%TEMP%\\reindulging]- [targetUID: 00000000-00004744]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" queries basic process information of the \"C:\\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" (UID: 4744)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" reads file \"c:\\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" trying to access non-existent file \"C:\\0F0CC7E07E9B2C3000EE7F2966241F4A21756770A4B775A151A38219FF3886C7.EXE.LOCAL\"\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\UXTHEME.DLL.CONFIG\"\n \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" trying to access non-existent file \"C:\\0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\reindulging\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"0f0cc7e07e9b2c3000ee7f2966241f4a21756770a4b775a151a38219ff3886c7.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004744.00000001.299382.00482000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"255.255.255.255\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"_h.ch\"\n Heuristic match: \"'mj.al\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"m>.eu\"\n Heuristic match: \"d&[.no\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f7e2881c9d553cd10dac64"},{"report_type":"sandbox","report_id":"6a7b90d2176422c1b4060c3e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004744.00000000.299312.03830000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004744.00000001.299382.03830000.00000004.mdmp\")\n Found URL \"http://https://