26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 11fa27c4961a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 11fa27c4961a…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e"],"about":{"@type":"SoftwareApplication","name":"bounty-31371552795824764","applicationCategory":["peexe","assembly","executable"],"identifier":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T500,"zsBrgGjP.exe" called "FindResourceW" with parameter "101" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "102" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "103" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "104" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "105" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "106" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "108" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "109" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "110" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "113" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "114" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "116" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "117" - (UID: 00000000-00002884) "zsBrgGjP.exe" called "FindResourceW" with parameter "118" - (UID: 00000000-00002884)28:T46e,Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 00000000-00002884-00000C1E-130660289 Observed string: "FreeLibraryAndExitThread" (Indicator: "FreeLibrary") in Source: 00000000-00000488-00000C1E-102385257 Observed string: "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary") in Source: 00000000-00002752-00000C1E-38832108 Observed string: "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "FreeLibrary(wsock2) failed (%u)" (Indicator: "FreeLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "FreeLibrary" (Indicator: "FreeLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "FreeLibraryAndExitThread" (Indicator: "FreeLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp29:T6f6,Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00002884-00000C1E-130632369 Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00002752-00000C1E-41220114 Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00002884-00000C1E-130641356 Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp Observed string: "VirtualFree" (Indicator: "VirtualFree") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "VirtualAlloc" (Indicator: "VirtualAlloc") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "VirtualAllocEx" (Indicator: "VirtualAlloc") in Source: 00000000-00002752.00000000.68065.00420000.00000004.mdmp 00000000-00002752.00000000.68065.01DC0000.00000004.mdmp 00000000-00002752.00000001.68085.00420000.00000004.mdmp 00000000-00002752.00000001.68085.01DC0000.00000004.mdmp2a:T42c,Observed string:"WriteProcessMemory" [Source: 00000000-00002752-00000C1E-41220671] Observed string:"WriteProcessMemory" [Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp] Observed string:"WriteProcessMemory" [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp] Observed string:"WriteProcessMemory" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"WriteProcessMemory" [Source: 00000000-00002752.00000000.68065.00420000.00000004.mdmp 00000000-00002752.00000000.68065.01DC0000.00000004.mdmp 00000000-00002752.00000001.68085.00420000.00000004.mdmp 00000000-00002752.00000001.68085.01DC0000.00000004.mdmp]2b:Tecd,Observed string: "-----BEGIN PUBLIC KEY-----" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "-----END PUBLIC KEY-----" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "public key hash: sha256//%s" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "SSL public key does not match pinned public key" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "SSL: public key does not match pinned public key!" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "SSL: failed retrieving public key from server certificate" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "RSA Public Key (%lu bits)" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "RSA Public Key" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "Public Key Algorithm" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "Public Key Algorithm: %s" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "X509v3 Private Key Usage Period" (Indicator: "private key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "ENCRYPTED PRIVATE KEY" (Indicator: "private key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "PRIVATE KEY" (Indicator: "private key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "PUBLIC KEY" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "ANY PRIVATE KEY" (Indicator: "private key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "unable to decode issuer public key" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "Suite B: invalid public key algorithm" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "Certificate public key has explicit ECC parameters" (Indicator: "public key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "RSA PRIVATE KEY" (Indicator: "private key") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp2c:T7be,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002752) ".exe" called "RtlGetVersion" (UID: 00000000-00002752) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000140000008000000000000000010000002807460090f03000688244000100000014000000020000000c0000001475406d409545003b95450000000000b4f030000000420030074601f8ef3000c0f0300018f6300095e16e77ccbb1800feffffff435c72775059727794000000a00000003a95450038954500940000009cf13000fdfead75c00a00001000000044f1300048f13000010000001c5c71772e916575ffffffff1a00000028f130000400000000000000ffffffff98f1300039f93e6d00000000a8f13000006bcb680100000047f93e6d0300000000000000a0000000 (UID: 00000000-00002752) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002752)2d:T468,Observed string:"EnumSystemLocalesW" [Source: 00000000-00002884-00000C1E-130741692] Observed string:"GetLocaleInfoEx" [Source: 00000000-00002752-00000C1E-16676345] Observed string:"GetLocaleInfoW" [Source: 00000000-00002884-00000C1E-99081530] Observed string:"GetUserDefaultLCID" [Source: 00000000-00002884-00000C1E-130740740] Observed string:"GetLocaleInfoEx" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"EnumSystemLocalesEx" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"GetLocaleInfoW" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"GetUserDefaultLCID" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"EnumSystemLocalesW" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]2e:T45f,Observed string: "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime") in Source: 00000000-00000488-00000C1E-102425911 Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: 00000000-00000488-00000C1E-102328452 Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00002884-00000C1E-130681895 Observed string: "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime") in Source: 00000000-00000488-00000C1E-102424708 Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp2f:T4da,Observed string: "GetLocalTime" (Indicator: "GetLocalTime") in Source: 00000000-00000488-00000C1E-102457340 Observed string: "GetSystemTime" (Indicator: "GetSystemTime") in Source: 00000000-00000488-00000C1E-102423717 Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00002884-00000C1E-130681895 Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00002752-00000C1E-38836517 Observed string: "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetSystemTime" (Indicator: "GetSystemTime") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp30:T451,Observed api:"GetForegroundWindow"[Source: 00000000-00003508-00000C1E-45231813] Observed api:"GetWindowText"[Source: 00000000-00000488-00000C1E-103056786] Observed api:"GetWindowText"[Source: 00000000-00000488-00000C1E-103056519] Observed api:"GetWindowText"[Source: 00000000-00003508-00000C1E-45234024] Observed api:"GetWindowText"[Source: 00000000-00001420.00000000.75067.0026B000.00000004.mdmp] Observed api:"GetWindowText"[Source: 00000000-00001976.00000000.75367.002B0000.00000004.mdmp] Observed api:"GetWindowText"[Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed api:"EnumWindows"[Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed api:"GetForegroundWindow"[Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed api:"FindWindow"[Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]31:T4be,Observed string:"GetVersionExA " [Source: 00000000-00000488-00000C1E-102461558] Observed string:"GetVersionExW " [Source: 00000000-00000488-00000C1E-102274682] Observed string:"RtlGetVersion " [Source: 00000000-00003508-00000C1E-23212965] Observed string:"VerifyVersionInfoA " [Source: 00000000-00000488-00000C1E-102352995] Observed string:"VerSetConditionMask " [Source: 00000000-00000488-00000C1E-102352039] Observed string:"RtlGetVersion " [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"VerSetConditionMask " [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"VerifyVersionInfoW " [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"GetVersionExW " [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"VerifyVersionInfoA " [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]32:Tbc1,".exe" called "CreateProcessW" with parameter ""cmd" /c mkdir "%APPDATA%\wbnh"" - (UID: 00000000-00002752) ".exe" called "CreateProcessW" with parameter ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00002752) ".exe" called "CreateProcessW" with parameter ""cmd" /c copy "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" "%APPDATA%\wbnh\wbn" - (UID: 00000000-00002752), ".exe" called "CreateProcessW" with parameter "-a "%LOCALAPPDATA%\1868f947\plg\zsBrgGjP.json"" - (UID: 00000000-00003508), "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00003152), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c mkdir "%APPDATA%\wbnh"" - (UID: 00000000-00003148), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00003148), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c copy "%APPDATA%\wbnh\wbnh.exe" "%APPDATA%\wbnh\wbnh.exe"" - (UID: 00000000-00003148), "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00001536), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c mkdir "%APPDATA%\wbnh"" - (UID: 00000000-00003096), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c copy "%APPDATA%\wbnh\wbnh.exe" "%APPDATA%\wbnh\wbnh.exe"" - (UID: 00000000-00003096), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00003096), "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00003164), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c mkdir "%APPDATA%\wbnh"" - (UID: 00000000-00001420), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00001420), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c copy "%APPDATA%\wbnh\wbnh.exe" "%APPDATA%\wbnh\wbnh.exe"" - (UID: 00000000-00001420), "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00002452), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c mkdir "%APPDATA%\wbnh"" - (UID: 00000000-00002312), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\wbnh\wbnh.exe'" /f" - (UID: 00000000-00002312), "wbnh.exe" called "CreateProcessW" with parameter ""cmd" /c copy "%APPDATA%\wbnh\wbnh.exe" "%APPDATA%\wbnh\wbnh.exe"" - (UID: 00000000-00002312)33:Ta02,Observed string: "CreateProcess" (Indicator: "CreateProcess") in Source: 00000000-00002752-00000C1E-19150339 Observed string: "CreateProcessA" (Indicator: "CreateProcess") in Source: 00000000-00000488-00000C1E-102463484 Observed string: "CreateProcessAsUser" (Indicator: "CreateProcess") in Source: 00000000-00002752-00000C1E-40884699 Observed string: "CreateProcessAsUserA" (Indicator: "CreateProcess") in Source: 00000000-00002752-00000C1E-40884876 Observed string: "CreateProcessW" (Indicator: "CreateProcess") in Source: 00000000-00002752-00000C1E-19151024 Observed string: "CreateProcessAsUser" (Indicator: "CreateProcess") in Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp Observed string: "18446744029992469962,1480,3129,,CreateProcessW,kernel32.dll,"252:06:08.093",RX=0,PX=0" (Indicator: "CreateProcess") in Source: 00000000-00001420.00000001.75151.00430000.00000004.mdmp Observed string: "CreateProcessAsUser" (Indicator: "CreateProcess") in Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp Observed string: "11058903881,3280,3129,,CreateProcessW,kernel32.dll,"252:07:28.468",RX=0,PX=0" (Indicator: "CreateProcess") in Source: 00000000-00002312.00000001.76456.002C0000.00000004.mdmp Observed string: "CreateProcessW" (Indicator: "CreateProcess") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "CreateProcessA" (Indicator: "CreateProcess") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "CreateProcessAsUser" (Indicator: "CreateProcess") in Source: 00000000-00002752.00000000.68065.00420000.00000004.mdmp 00000000-00002752.00000000.68065.00CB0000.00000004.mdmp 00000000-00002752.00000000.68065.01DC0000.00000004.mdmp 00000000-00002752.00000001.68085.00420000.00000004.mdmp 00000000-00002752.00000001.68085.00CB0000.00000004.mdmp 00000000-00002752.00000001.68085.01DC0000.00000004.mdmp Observed string: "8008465785,3544,3129,,CreateProcessW,kernel32.dll,"252:03:17.703",RX=0,PX=0" (Indicator: "CreateProcess") in Source: 00000000-00002752.00000001.68085.00420000.00000004.mdmp34:Tce0,Observed API string: "CreateThread" [Source: 00000000-00000488-00000C1E-102383326] Observed API string: "CreateThread" [Source: 00000000-00002752-00000C1E-38826731] Observed API string: "CreateThread" [Source: 00000000-00002752-00000C1E-38829180] Observed API string: "CreateThread" [Source: 00000000-00002752-00000C1E-38843012] Observed API string: "GetThreadContext" [Source: 00000000-00002752-00000C1E-18966638] Observed API string: "OpenThread" [Source: 00000000-00002752-00000C1E-16770918] Observed API string: "ResumeThread" [Source: 00000000-00002752-00000C1E-41255795] Observed API string: "SetThreadContext" [Source: 00000000-00002752-00000C1E-41254455] Observed API string: "GetThreadContext" [Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp] Observed API string: "SetThreadContext" [Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp] Observed API string: "ResumeThread" [Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp] Observed API string: "GetThreadContext" [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp] Observed API string: "SetThreadContext" [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp] Observed API string: "ResumeThread" [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp] Observed API string: "CreateThread" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed API string: "SuspendThread" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed API string: "ResumeThread" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed API string: "GetThreadContext" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed API string: "SetThreadContext" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed API string: "OpenThread" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]35:T6ad,"freebl3.dll" contains export function called "FREEBL_GetVector" at ordinal 1 "softokn3.dll" contains export function called "C_GetFunctionList" at ordinal 1 "softokn3.dll" contains export function called "FC_GetFunctionList" at ordinal 2 "softokn3.dll" contains export function called "NSC_GetFunctionList" at ordinal 3 "softokn3.dll" contains export function called "NSC_ModuleDBFunc" at ordinal 4 "vcruntime140.dll" contains export function called "_CreateFrameInfo" at ordinal 1 "vcruntime140.dll" contains export function called "_CxxThrowException" at ordinal 2 "vcruntime140.dll" contains export function called "_EH_prolog" at ordinal 3 "vcruntime140.dll" contains export function called "_FindAndUnlinkFrame" at ordinal 4 "vcruntime140.dll" contains export function called "_IsExceptionObjectToBeDestroyed" at ordinal 5 "vcruntime140.dll" contains export function called "_NLG_Dispatch2" at ordinal 6 "vcruntime140.dll" contains export function called "_NLG_Return" at ordinal 7 "vcruntime140.dll" contains export function called "_NLG_Return2" at ordinal 8 "vcruntime140.dll" contains export function called "_SetWinRTOutOfMemoryExceptionCallback" at ordinal 9 "vcruntime140.dll" contains export function called "__AdjustPointer" at ordinal 10 "vcruntime140.dll" contains export function called "__BuildCatchObject" at ordinal 11 "vcruntime140.dll" contains export function called "__BuildCatchObjectHelper" at ordinal 12 "vcruntime140.dll" contains export function called "__CxxDetectRethrow" at ordinal 13 "vcruntime140.dll" contains export function called "__CxxExceptionFilter" at ordinal 14 "vcruntime140.dll" contains export function called "__CxxFrameHandler" at ordinal 1536:Taed,Antivirus vendors marked dropped file "freebl3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "softokn3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcp140.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-locale-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-filesystem-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-runtime-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-conio-l1-1-0_not.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-time-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-heap-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-stdio-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nss3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-utility-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-string-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "mozglue.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-environment-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-math-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-multibyte-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "api-ms-win-crt-convert-l1-1-0.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows")37:T600,Observed keyword:".Run" [Source: 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin] Observed keyword:".Run" [Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp 00000000-00001420.00000001.75151.00430000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00001420.00000000.75067.00430000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00001420.00000000.75067.023C0000.00000004.mdmp 00000000-00001420.00000001.75151.023C0000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00001420.00000001.75151.00430000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp 00000000-00002312.00000001.76456.002C0000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002312.00000000.76354.023C0000.00000004.mdmp 00000000-00002312.00000001.76456.023C0000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002312.00000001.76456.002C0000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002752.00000000.68065.00420000.00000004.mdmp 00000000-00002752.00000001.68085.00420000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002752.00000000.68065.00420000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002752.00000000.68065.01DC0000.00000004.mdmp 00000000-00002752.00000001.68085.01DC0000.00000004.mdmp] Observed keyword:".Run" [Source: 00000000-00002752.00000001.68085.00420000.00000004.mdmp]38:T523,"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin" has an executable section named ".text" "freebl3.dll" has an executable section named ".text" "softokn3.dll" has an executable section named ".text" "vcruntime140.dll" has an executable section named ".text" "msvcp140.dll" has an executable section named ".text" "api-ms-win-crt-locale-l1-1-0.dll" has an executable section named ".text" "api-ms-win-crt-filesystem-l1-1-0.dll" has an executable section named ".text" "api-ms-win-crt-runtime-l1-1-0.dll" has an executable section named ".text" "api-ms-win-crt-conio-l1-1-0_not.dll" has an executable section named ".text" "api-ms-win-crt-time-l1-1-0.dll" has an executable section named ".text" "api-ms-win-crt-heap-l1-1-0.dll" has an executable section named ".text" "api-ms-win-crt-stdio-l1-1-0.dll" has an executable section named ".text" "Unknown.dll" has an executable section named "" "nss3.dll" has an executable section named ".text" "api-ms-win-crt-utility-l1-1-0.dll" has an executable section named ".text" "api-ms-win-crt-string-l1-1-0.dll" has an executable section named ".text" "mozglue.dll" has an executable section named ".text" "api-ms-win-crt-environment-l1-1-0.dll" has an executable section named ".text" "wbnh.exe" has an executable section named ".text"39:T23c1,"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "freebl3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003d717,call 0x1003d89e,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003d5e3,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x1003f038],push dword ptr [ebp + 8],call dword ptr [0x1003f020],push 0xc0000409,call dword ptr [0x1003f030],push eax,call dword ptr [0x1003f01c],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x1003e04c,test eax, eax,je 0x1003d76d,push 2,pop ecx,int 0x29," "softokn3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1001bca5,call 0x1001bd09,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1001bb71,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x1001d008],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax,call dword ptr [0x1001d00c],xor dword ptr [ebp - 4], eax,call dword ptr [0x1001d010],xor dword ptr [ebp - 4], eax,lea eax, [ebp - 0x14],push eax,call dword ptr [0x1001d014],mov eax, dword ptr [ebp - 0x10]," "vcruntime140.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000ae0e,call 0x1000eaf0,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1000ad85,pop ebp,ret 0xc,int3 ,int3 ,int3 ,push esi,inc ebx,xor dword ptr [eax], esi,pop eax,inc ebx,xor byte ptr [eax], dh,push ebp,mov ebp, esp,sub esp, 8,push ebx,push esi,push edi,push ebp,cld ,push dword ptr [ebp + 0x10],call 0x10002671,add esp, 4,mov ebx, dword ptr [ebp + 0xc],mov eax, dword ptr [ebp + 8],test dword ptr [eax + 4], 6,jne 0x1000aec4,mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0x10],mov dword ptr [ebp - 4], eax,lea eax, [ebp - 8],mov dword ptr [ebx + 0x14], eax,mov esi, dword ptr [ebx + 0xc],mov edi, dword ptr [ebx + 8]," "msvcp140.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003b15e,call 0x1003b5d2,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003b024,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x1000ffb0,mov dword ptr [esi], 0x1000286c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x10002874,mov dword ptr [ecx], 0x1000286c,ret ,int3 ," "api-ms-win-crt-locale-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-filesystem-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-runtime-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-conio-l1-1-0_not.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-time-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-heap-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-stdio-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "Unknown.dll" file has an entrypoint instructions - "cmp byte ptr [esp + 8], 1,jne 0x10224435,pushal ,mov esi, 0x10162000,lea edi, [esi - 0x161000],mov dword ptr [edi + 0x1b77e0], 0xd564e0ab,push edi,jmp 0x10224272,nop ,nop ,nop ,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x10224279,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x10224268,mov eax, 1,add ebx, ebx,jne 0x1022428b,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x1022429c,jne 0x102242bb,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x102242bb,dec eax,add ebx, ebx,jne 0x102242a8,mov ebx, dword ptr [esi]," "nss3.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100ee862,call 0x100ee8c6,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100ee72e,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x100f010c],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax,call dword ptr [0x100f007c],xor dword ptr [ebp - 4], eax,call dword ptr [0x100f00f8],xor dword ptr [ebp - 4], eax,lea eax, [ebp - 0x14],push eax,call dword ptr [0x100f0120],mov eax, dword ptr [ebp - 0x10]," "api-ms-win-crt-utility-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "api-ms-win-crt-string-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "mozglue.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000ccd3,call 0x1000d07a,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000cb9f,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x1000d2d0,test eax, eax,je 0x1000cd02,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x1000ce04,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x1000d282,add esp, 0xc,mov dword ptr [ebp - 0x274], eax," "api-ms-win-crt-environment-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "wbnh.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "api-ms-win-crt-math-l1-1-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,"3a:T431,Process "schtasks.exe" (UID: 00000000-00001404) was launched with new environment variables: "PROMPT="$P$G"" Process "wbnh.exe" (UID: 00000000-00003148) was launched with missing environment variables: "PROMPT" Process "schtasks.exe" (UID: 00000000-00002084) was launched with new environment variables: "PROMPT="$P$G"" Process "wbnh.exe" (UID: 00000000-00003096) was launched with missing environment variables: "PROMPT" Process "schtasks.exe" (UID: 00000000-00002248) was launched with new environment variables: "PROMPT="$P$G"" Process "wbnh.exe" (UID: 00000000-00001420) was launched with missing environment variables: "PROMPT" Process "schtasks.exe" (UID: 00000000-00002444) was launched with new environment variables: "PROMPT="$P$G"" Process "wbnh.exe" (UID: 00000000-00002312) was launched with missing environment variables: "PROMPT" Process "schtasks.exe" (UID: 00000000-00003932) was launched with new environment variables: "PROMPT="$P$G"" Process ".exe" (UID: 00000000-00003928) was launched with missing environment variables: "PROMPT"3b:T5f7,""cmd" /c mkdir "%APPDATA%\\wbnh"" on 2023-3-17.23:12:35.070 ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" on 2023-3-17.23:12:35.258 ""cmd" /c copy "C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" "%APPDATA%\\wbnh\\wbnh.exe"" on 2023-3-17.23:12:35.477 ""cmd" /c mkdir "%APPDATA%\\wbnh"" on 2023-3-17.23:13:06.195 ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" on 2023-3-17.23:13:06.492 ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" on 2023-3-17.23:13:06.680 ""cmd" /c mkdir "%APPDATA%\\wbnh"" on 2023-3-17.23:14:11.586 ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" on 2023-3-17.23:14:11.820 ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" on 2023-3-17.23:14:12.242 ""cmd" /c mkdir "%APPDATA%\\wbnh"" on 2023-3-17.23:15:45.070 ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" on 2023-3-17.23:15:45.445 ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" on 2023-3-17.23:15:45.867 ""cmd" /c mkdir "%APPDATA%\\wbnh"" on 2023-3-17.23:16:45.398 ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" on 2023-3-17.23:16:45.633 ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" on 2023-3-17.23:16:45.961 ""cmd" /c mkdir "%APPDATA%\\wbnh"" on 2023-3-17.23:17:22.1643c:T816,Spawned process ".exe" (UID: 00000000-00003508) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00002864) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'% ..." (UID: 00000000-00003152), Spawned process "cmd.exe" with commandline ""cmd" /c copy "C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2 ..." (UID: 00000000-00003656), Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA% ..." (UID: 00000000-00001404), Spawned process "wbnh.exe" (UID: 00000000-00003148), Spawned process "wbnh.exe" (UID: 00000000-00004044), Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00003552), Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'% ..." (UID: 00000000-00001536) Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh ..." (UID: 00000000-00004048), Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA% ..." (UID: 00000000-00002084) Spawned process "wbnh.exe" (UID: 00000000-00003096) Spawned process "wbnh.exe" (UID: 00000000-00002612) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00001928) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'% ..." (UID: 00000000-00003164), Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh ..." (UID: 00000000-00002524), Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA% ..." (UID: 00000000-00002248), Spawned process "wbnh.exe" (UID: 00000000-00001420), Spawned process "wbnh.exe" (UID: 00000000-00001976), Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00002556)3d:T816,Spawned process ".exe" (UID: 00000000-00003508) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00002864) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'% ..." (UID: 00000000-00003152), Spawned process "cmd.exe" with commandline ""cmd" /c copy "C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2 ..." (UID: 00000000-00003656), Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA% ..." (UID: 00000000-00001404), Spawned process "wbnh.exe" (UID: 00000000-00003148), Spawned process "wbnh.exe" (UID: 00000000-00004044), Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00003552), Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'% ..." (UID: 00000000-00001536) Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh ..." (UID: 00000000-00004048), Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA% ..." (UID: 00000000-00002084) Spawned process "wbnh.exe" (UID: 00000000-00003096) Spawned process "wbnh.exe" (UID: 00000000-00002612) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00001928) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'% ..." (UID: 00000000-00003164), Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh ..." (UID: 00000000-00002524), Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA% ..." (UID: 00000000-00002248), Spawned process "wbnh.exe" (UID: 00000000-00001420), Spawned process "wbnh.exe" (UID: 00000000-00001976), Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00002556)3e:T54e,Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00000488-00000C1E-102489639 Observed string: "LoadLibraryExA" (Indicator: "LoadLibrary") in Source: 00000000-00002884-00000C1E-130661293 Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00002884-00000C1E-130719625 Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: 00000000-00000488-00000C1E-102256342 Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00000488.00000000.77883.10226000.00000004.mdmp 00000000-00000488.00000001.78557.10226000.00000004.mdmp Observed string: "LoadLibraryExA" (Indicator: "LoadLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "LoadLibraryA" (Indicator: "LoadLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "LoadLibraryW" (Indicator: "LoadLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "LoadLibraryExW" (Indicator: "LoadLibrary") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp3f:Tf40,"freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\freebl3.dll]- [targetUID: 00000000-00002884] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\softokn3.dll]- [targetUID: 00000000-00002884] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\vcruntime140.dll]- [targetUID: 00000000-00002884] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\msvcp140.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-conio-l1-1-0_not.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00002884] "Unknown.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\Unknown.dll]- [targetUID: 00000000-00000488] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\nss3.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00002884] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\mozglue.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00002884] "zsBrgGjP.exe" has type "MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB) Mono/.Net assembly for MS Windows"- Location: [%TEMP%\zsBrgGjP.exe]- [targetUID: 00000000-00003508] "wbnh.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\wbnh\wbnh.exe]- [targetUID: 00000000-00002524] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00002884]40:T541,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "cmd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "cmd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "cmd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "cmd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "wbnh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "wbnh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "wbnh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "wbnh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "wbnh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"41:T5d7,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to access non-existent file "C:\cmd.exe" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL"42:T602,".exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\11FA27C4961ACEA6B79C28CCDC896BB94276BA6E3EDF2E1D33539952ABB1C25E.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MIAEEC" ".exe" trying to access non-existent file "C:\11FA27C4961ACEA6B79C28CCDC896BB94276BA6E3EDF2E1D33539952ABB1C25E.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\WBNH" ".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\miAeec\" ".exe" trying to access non-existent file "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.INI" ".exe" trying to access non-existent file "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe.Local\"43:T86d,Heuristic match: "$SD.pN" Heuristic match: ".K.MY" Heuristic match: "3C.Im" Heuristic match: "_N.DE" Heuristic match: "Cp.Kh" Heuristic match: "IL.Li" Heuristic match: "LN.Li" Heuristic match: "w_.Im" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "PATHEXT=.CV" Pattern match: "www.xenarmor.com" Heuristic match: "xenarmor.com" Heuristic match: "enarmor.com" Heuristic match: "armor.com" Heuristic match: "ww.xenarmor.com" Heuristic match: "mor.com" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "orlib.ni" Heuristic match: "Users\HAPUBWS\AppData\Roaming\wbnh\wbnh.exe.cx" Pattern match: "Microsoft.Net/assembly/GAC_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "https://curl.haxx.se/docs/http-cookies.html" Heuristic match: "ftp@example.com" Heuristic match: ".Http.Tr" Heuristic match: "CmT.Cm" Heuristic match: "11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe.co" Pattern match: "www.digicert.com110/" Heuristic match: "AT;.CM" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0"44:T814,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002752) ".exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002752) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\miAeec\* (UID: 00000000-00002752) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00002752)45:T526,Observed string: "RegEnumKeyExA" (Indicator: "RegEnumKey") in Source: 00000000-00000488-00000C1E-102564646 Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00002752-00000C1E-15478488 Observed string: "RegOpenKeyEx" (Indicator: "RegOpenKey") in Source: 00000000-00002752-00000C1E-16576675 Observed string: "RegOpenKeyExA" (Indicator: "RegOpenKey") in Source: 00000000-00000488-00000C1E-102568041 Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00002752-00000C1E-16577353 Observed string: "RegQueryValueExA" (Indicator: "RegQueryValue") in Source: 00000000-00004044-00000C1E-37802935 Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00002752-00000C1E-15481867 Observed string: "RegQueryValueExW" (Indicator: "RegQueryValue") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "RegOpenKeyExW" (Indicator: "RegOpenKey") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "RegEnumKeyExW" (Indicator: "RegEnumKey") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp46:Tce0,Observed string: "GetCurrentDirectory" (Indicator: "GetCurrentDirectory") in Source: 00000000-00002752-00000C1E-19148976 Observed string: "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory") in Source: 00000000-00000488-00000C1E-102240024 Observed string: "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory") in Source: 00000000-00002752-00000C1E-19149649 Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00000488-00000C1E-102480688 Observed string: "GetFileSizeEx" (Indicator: "GetFileSize") in Source: 00000000-00000488-00000C1E-102346278 Observed string: "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo") in Source: 00000000-00000488-00000C1E-103184143 Observed string: "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo") in Source: 00000000-00000488-00000C1E-103183882 Observed string: "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00000488-00000C1E-103183882 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002752-00000C1E-15694823 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00002752-00000C1E-15694823 Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002752-00000C1E-39020280 Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 00000000-00000488-00000C1E-102330704 Observed string: "GetTempFileNameA" (Indicator: "GetTempFileName") in Source: 00000000-00000488-00000C1E-102354144 Observed string: "GetTempPathA" (Indicator: "GetTempPath") in Source: 00000000-00000488-00000C1E-102478748 Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00002884-00000C1E-130630500 Observed string: "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation") in Source: 00000000-00000488-00000C1E-102970817 Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetTempPathW" (Indicator: "GetTempPath") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetSystemDirectoryW" (Indicator: "GetSystemDirectory") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetFileSize" (Indicator: "GetFileSize") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp Observed string: "GetSystemDirectoryA" (Indicator: "GetSystemDirectory") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp47:T457,Observed string:"GetAsyncKeyState" [Source: 00000000-00000488-00000C1E-103077438] Observed string:"GetKeyboardState" [Source: 00000000-00000488-00000C1E-103025804] Observed string:"GetKeyNameTextA" [Source: 00000000-00000488-00000C1E-103016822] Observed string:"GetKeyState" [Source: 00000000-00000488-00000C1E-103059665] Observed string:"MapVirtualKeyA" [Source: 00000000-00000488-00000C1E-103016564] Observed string:"MapVirtualKeyExA" [Source: 00000000-00000488-00000C1E-103025543] Observed string:"GetKeyState" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"VkKeyScanW" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"GetKeyboardState" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp] Observed string:"MapVirtualKeyW" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]48:T5ef,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE1") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE2") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE3") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE4") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE5") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE6") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE7") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE8") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E96E-E325-11CE-BFC1-08002BE10318}\0002\MODES\640,480"; Key: "MODE9")49:T6bd,Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: nss3.dll] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nss3.dll] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: nss3.dll] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nss3.dll] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: nss3.dll] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nss3.dll] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: nss3.dll] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: nss3.dll] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nss3.dll] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: nss3.dll] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: nss3.dll] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: nss3.dll]4a:Tf7c,"freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\freebl3.dll]- [targetUID: 00000000-00002884] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\softokn3.dll]- [targetUID: 00000000-00002884] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\vcruntime140.dll]- [targetUID: 00000000-00002884] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\msvcp140.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-conio-l1-1-0_not.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00002884] "Unknown.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\Unknown.dll]- [targetUID: 00000000-00000488] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\nss3.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00002884] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\mozglue.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00002884] "zsBrgGjP.exe" has type "MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB) Mono/.Net assembly for MS Windows"- Location: [%TEMP%\zsBrgGjP.exe]- [targetUID: 00000000-00003508] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-multibyte-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll]- [targetUID: 00000000-00002884]4b:T619,"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin" was detected as "Microsoft visual C# v7.0 / Basic .NET" "freebl3.dll" was detected as "Borland Delphi 3.0 (???)" "softokn3.dll" was detected as "Borland Delphi 3.0 (???)" "vcruntime140.dll" was detected as "Borland Delphi 3.0 (???)" "msvcp140.dll" was detected as "Borland Delphi 3.0 (???)" "api-ms-win-crt-locale-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-filesystem-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-runtime-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-conio-l1-1-0_not.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-time-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-heap-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-stdio-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "Unknown.dll" was detected as "ACProtect v1.3x - v1.4x DLL -> Risco Software Inc." "nss3.dll" was detected as "Borland Delphi 3.0 (???)" "api-ms-win-crt-utility-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "api-ms-win-crt-string-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "mozglue.dll" was detected as "Borland Delphi 3.0 (???)" "api-ms-win-crt-environment-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL" "wbnh.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "api-ms-win-crt-math-l1-1-0.dll" was detected as "Microsoft visual C++ vx.x DLL"4c:Tf40,"freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\freebl3.dll]- [targetUID: 00000000-00002884] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\softokn3.dll]- [targetUID: 00000000-00002884] "vcruntime140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\vcruntime140.dll]- [targetUID: 00000000-00002884] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\msvcp140.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-locale-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-filesystem-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-runtime-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-conio-l1-1-0_not.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-time-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-heap-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-stdio-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll]- [targetUID: 00000000-00002884] "Unknown.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\Unknown.dll]- [targetUID: 00000000-00000488] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\nss3.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-utility-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-string-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll]- [targetUID: 00000000-00002884] "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\mozglue.dll]- [targetUID: 00000000-00002884] "api-ms-win-crt-environment-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll]- [targetUID: 00000000-00002884] "zsBrgGjP.exe" has type "MS-DOS executable PE32 executable (console) Intel 80386 (stripped to external PDB) Mono/.Net assembly for MS Windows"- Location: [%TEMP%\zsBrgGjP.exe]- [targetUID: 00000000-00003508] "wbnh.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%APPDATA%\wbnh\wbnh.exe]- [targetUID: 00000000-00002524] "api-ms-win-crt-math-l1-1-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%TEMP%\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll]- [targetUID: 00000000-00002884]4d:T213a,".exe" wrote 402 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe": 4d5a6b65726e656c33320000504500004c01030000000000000000000000000078000f030b01000000000000000000000000000014310000000000000c00000000004000001000000002000004000000010000000400000000000000ff3100001401000000000000030000000000100000100000000000000000000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 28672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 24576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\freebl3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\mozglue.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\msvcp140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\nss3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\softokn3.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zsBrgGjP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4e:T96a,"6.9.0.114" Potential IP "1.0.0.0" found in string "Microsoft.Windows.IsolationAutomation,processorArchitecture="x86",publicKeyToken="6595b64144ccf1df",type="win32",version="1.0.0.0"C:\Windows\WinSxS\manifests\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest" "10.0.0.1" Potential IP "1.0.0.0" found in string "MyApplication.app,version="1.0.0.0"C:\Users\HAPUBWS\AppData\Roaming\wbnh\wbnh.exe" Potential IP "4.0.0.0" found in string "em.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "0.0.0.0" found in string "0.0.0.0, Cul" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="Everywhere" />" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35"/>" Potential IP "1.0.0.0" found in string "" "2.4.13.6" "74.201.28.92" Potential IP "74.201.28.92" found in string "\74.201.28.92" "4.201.28.92" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=n" Potential IP "127.0.0.1" found in string "127.0.0.1/" Potential IP "127.0.0.1" found in string "Invalid file://hostname/, expected localhost or 127.0.0.1 or none" "2.5.4.3" "2.5.29.17" "2.5.4.4" "2.5.4.5" "2.5.4.6" "2.5.4.7" "2.5.4.8" "2.5.4.9" "2.5.4.10" "2.5.4.11" "2.5.4.12" "2.5.4.13" "2.5.4.17" "2.5.4.41" "2.5.4.42" "2.5.4.43" "2.5.4.44" "2.5.4.45" "2.5.4.46" "2.5.4.65" "2.5.4.72" "2.5.29.18" "2.5.29.19" "255.255.255.255" Potential IP "1.0.0.0" found in string "MyApplication.app,version="1.0.0.0"C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" Potential IP "4.5.9.0" found in string "ersion=4.5.9.0, Culture=neutral, PublicKeyToken=" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neu" Potential IP "4.0.0.0" found in string "sion=4.0.0.0," Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"4f:Tb9d,Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00000488.00000000.77883.00A50000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00000488.00000000.77883.00A50000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00000488.00000000.77883.00A50000.00000002.mdmp") Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00001420.00000000.75067.017C0000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00001420.00000000.75067.017C0000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00001420.00000000.75067.017C0000.00000002.mdmp") Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00001976.00000000.75367.017C0000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00001976.00000000.75367.017C0000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00001976.00000000.75367.017C0000.00000002.mdmp") Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00002312.00000000.76354.017C0000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00002312.00000000.76354.017C0000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00002312.00000000.76354.017C0000.00000002.mdmp") Found string "MSTaskListWClass" (Indicator: "tasklist"; in Source: "00000000-00002536.00000000.76672.017C0000.00000002.mdmp") Found string "TaskListOverlayWnd" (Indicator: "tasklist"; in Source: "00000000-00002536.00000000.76672.017C0000.00000002.mdmp") Found string "TaskListThumbnailWnd" (Indicator: "tasklist"; in Source: "00000000-00002536.00000000.76672.017C0000.00000002.mdmp") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; in Source: "00000000-00002612.00000000.71916.009B0000.00000002.mdmp, 00000000-00002612.00000001.71962.009B0000.00000002.mdmp") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; in Source: "00000000-00002612.00000000.71916.009B0000.00000002.mdmp, 00000000-00002612.00000001.71962.009B0000.00000002.mdmp") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; in Source: "00000000-00002612.00000000.71916.009B0000.00000002.mdmp, 00000000-00002612.00000001.71962.009B0000.00000002.mdmp") Found string "Invalid file://hostname/, expected localhost or 127.0.0.1 or none" (Indicator: "hostname"; in Source: "00000000-00002612.00000000.71916.009B0000.00000002.mdmp, 00000000-00002612.00000001.71962.009B0000.00000002.mdmp") Found string "Connecting to hostname: %s" (Indicator: "hostname"; in Source: "00000000-00002612.00000000.71916.009B0000.00000002.mdmp, 00000000-00002612.00000001.71962.009B0000.00000002.mdmp")50:T5de,"freebl3.dll" claimed CRC 388521 while the actual is CRC 4018626 "softokn3.dll" claimed CRC 152839 while the actual is CRC 388521 "vcruntime140.dll" claimed CRC 135612 while the actual is CRC 152839 "msvcp140.dll" claimed CRC 490081 while the actual is CRC 135612 "api-ms-win-crt-locale-l1-1-0.dll" claimed CRC 76357 while the actual is CRC 490081 "api-ms-win-crt-filesystem-l1-1-0.dll" claimed CRC 49737 while the actual is CRC 76357 "api-ms-win-crt-runtime-l1-1-0.dll" claimed CRC 27081 while the actual is CRC 49737 "api-ms-win-crt-conio-l1-1-0_not.dll" claimed CRC 64538 while the actual is CRC 27081 "api-ms-win-crt-time-l1-1-0.dll" claimed CRC 49600 while the actual is CRC 64538 "api-ms-win-crt-heap-l1-1-0.dll" claimed CRC 68532 while the actual is CRC 49600 "api-ms-win-crt-stdio-l1-1-0.dll" claimed CRC 76244 while the actual is CRC 68532 "nss3.dll" claimed CRC 1306341 while the actual is CRC 828353 "api-ms-win-crt-utility-l1-1-0.dll" claimed CRC 79096 while the actual is CRC 1306341 "api-ms-win-crt-string-l1-1-0.dll" claimed CRC 73282 while the actual is CRC 79096 "mozglue.dll" claimed CRC 147306 while the actual is CRC 73282 "api-ms-win-crt-environment-l1-1-0.dll" claimed CRC 66631 while the actual is CRC 147306 "api-ms-win-crt-math-l1-1-0.dll" claimed CRC 57810 while the actual is CRC 4018626 "api-ms-win-crt-multibyte-l1-1-0.dll" claimed CRC 46776 while the actual is CRC 57810 "api-ms-win-crt-convert-l1-1-0.dll" claimed CRC 44974 while the actual is CRC 4677651:T410,TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetTickCount GetLogicalDrives GetComputerNameA GetTempPathA GetModuleFileNameW LoadLibraryExW GetProcAddress GetModuleHandleW CopyFileW GetNativeSystemInfo GetSystemInfo VirtualProtect LoadLibraryExA CreateDirectoryW FindNextFileW GetTempPathW FindFirstFileExW GetFileAttributesExW GetModuleHandleExW CreateFileW Sleep RegCloseKey LoadLibraryA SetSecurityDescriptorDacl OpenProcessToken GetFileAttributesA GetFileAttributesW OpenFileMappingA GetThreadContext OutputDebugStringW OutputDebugStringA LoadLibraryW GetVersionExA GetFileSize CreateDirectoryA DeleteFileA DeleteFileW CreateFileMappingW WriteFile FindFirstFileA CreateFileMappingA FindNextFileA CreateFileA MapViewOfFile GetModuleHandleA CreateProcessA GetFileAttributesExA accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto RegOpenKeyExW VirtualAllocEx GetTickCount64 SleepConditionVariableCS VirtualProtectEx VirtualAlloc52:T79f,".exe" wrote bytes "db4d436d00000000" to virtual address "0x008D2000" (part of module "11FA27C4961ACEA6B79C28CCDC896BB94276BA6E3EDF2E1D33539952ABB1C25E.EXE") ".exe" wrote bytes "19a80acc" to virtual address "0x68B6F798" (part of module "CLR.DLL") "wbnh.exe" wrote bytes "1a5cfaf9" to virtual address "0x6899F798" (part of module "CLR.DLL") "wbnh.exe" wrote bytes "db4dfa7100000000" to virtual address "0x00E32000" (part of module "WBNH.EXE") "wbnh.exe" wrote bytes "1beab88d" to virtual address "0x681EF798" (part of module "CLR.DLL") "wbnh.exe" wrote bytes "db4db86d00000000" to virtual address "0x002F2000" (part of module "WBNH.EXE") "wbnh.exe" wrote bytes "d0b53d40" to virtual address "0x6899F798" (part of module "CLR.DLL") "wbnh.exe" wrote bytes "db4db36d00000000" to virtual address "0x013E2000" (part of module "WBNH.EXE") "wbnh.exe" wrote bytes "78625166" to virtual address "0x681EF798" (part of module "CLR.DLL") "wbnh.exe" wrote bytes "db4db86d00000000" to virtual address "0x013E2000" (part of module "WBNH.EXE") "zsBrgGjP.exe" wrote bytes "e9025565f7" to virtual address "0x75D93C29" ("ShellExecuteW@SHELL32.DLL") "zsBrgGjP.exe" wrote bytes "e95b0442f7" to virtual address "0x75FC8790" ("ShellExecuteA@SHELL32.DLL") "zsBrgGjP.exe" wrote bytes "fae66d77e1a672772e717277ee29727785e26d776da0727726e46d77d16d7277003d7077804b707700000000ad37cd758b2dcd75b641cd7500000000" to virtual address "0x74A41000" (part of module "WSHTCPIP.DLL") "zsBrgGjP.exe" wrote bytes "d5d9ad7530c6ad75e0c2ad7542c6ad7510c6ad75acdcad75a0dfad7536daad7587f1ad75000000009177d375c090d3757f6fd3751ffad375def4d375f282d375857dd37500000000" to virtual address "0x6E771000" (part of module "MSIMG32.DLL") "zsBrgGjP.exe" wrote bytes "e7396e77e1a672772e717277ee29727785e26d776da07277906471773ad5787726e46d77d16d7277003d7077804b707700000000ad37cd758b2dcd75b641cd7500000000" to virtual address "0x74F91000" (part of module "WSHIP6.DLL")53:T7de,33/69 Antivirus vendors marked spawned process ".exe" (PID: 3508) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "cmd.exe" (PID: 3656) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 3148) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 4044) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 3096) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 2612) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 1420) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 1976) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 2312) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 2536) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 33/69 Antivirus vendors marked spawned process ".exe" (PID: 3928) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate) 24/68 Antivirus vendors marked spawned process "zsBrgGjP.exe" (PID: 2884) as malicious (classified as "VHO:Trojan" with 35% detection rate) 24/68 Antivirus vendors marked spawned process "zsBrgGjP.exe" (PID: 488) as malicious (classified as "VHO:Trojan" with 35% detection rate) 33/69 Antivirus vendors marked spawned process "wbnh.exe" (PID: 3008) as malicious (classified as "Trojan.Z.Kryptik" with 47% detection rate)54:T1564,".exe" wrote 4 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 1024 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 4608 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 512 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 150016 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 32 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 52 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 3009536 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 703488 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 74240 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 604) ".exe" wrote 32 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 896) ".exe" wrote 52 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 896) ".exe" wrote 4 bytes to a remote process "C:\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" (Handle: 896) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe" (Handle: 656) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe" (Handle: 656) ".exe" wrote 4096 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe" (Handle: 656) ".exe" wrote 3548160 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe" (Handle: 656) ".exe" wrote 1536 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe" (Handle: 656) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\zsBrgGjP.exe" (Handle: 656) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 140) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 140) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 140) "wbnh.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 3009536 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 703488 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 74240 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 4608 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "wbnh.exe" wrote 150016 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 604) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 136) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 136) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 136) "wbnh.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 74240 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 150016 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 3009536 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 703488 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 4608 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608) "wbnh.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\wbnh\wbnh.exe" (Handle: 608)55:Tf7f,Spawned process ".exe" (UID: 00000000-00002752) Spawned process ".exe" (UID: 00000000-00003508) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00002864) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00003152) Spawned process "cmd.exe" with commandline ""cmd" /c copy "C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" "%APPDATA%\\wbnh\\wbnh.exe"" (UID: 00000000-00003656) Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00001404) Spawned process "wbnh.exe" (UID: 00000000-00003148) Spawned process "wbnh.exe" (UID: 00000000-00004044) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00003552) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00001536) Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" (UID: 00000000-00004048) Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00002084) Spawned process "wbnh.exe" (UID: 00000000-00003096) Spawned process "wbnh.exe" (UID: 00000000-00002612) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00001928) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00003164) Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" (UID: 00000000-00002524) Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00002248) Spawned process "wbnh.exe" (UID: 00000000-00001420) Spawned process "wbnh.exe" (UID: 00000000-00001976) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00002556) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00002452) Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" (UID: 00000000-00003568) Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00002444) Spawned process "wbnh.exe" (UID: 00000000-00002312) Spawned process "wbnh.exe" (UID: 00000000-00002536) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00001900) Spawned process "cmd.exe" with commandline ""cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00002896) Spawned process "cmd.exe" with commandline ""cmd" /c copy "%APPDATA%\\wbnh\\wbnh.exe" "%APPDATA%\\wbnh\\wbnh.exe"" (UID: 00000000-00002872) Spawned process "schtasks.exe" with commandline "schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'%APPDATA%\\wbnh\\wbnh.exe'" /f" (UID: 00000000-00003932) Spawned process ".exe" with commandline "-a "%LOCALAPPDATA%\\1868f947\\plg\\zsBrgGjP.json"" (UID: 00000000-00003928) Spawned process "zsBrgGjP.exe" with commandline "-a "%LOCALAPPDATA%\\1868f947\\plg\\zsBrgGjP.json"" (UID: 00000000-00002884) Spawned process "zsBrgGjP.exe" with commandline "-a "%TEMP%\\unk.xml"" (UID: 00000000-00000488) Spawned process "wbnh.exe" (UID: 00000000-00003008) Spawned process "cmd.exe" with commandline ""cmd" /c mkdir "%APPDATA%\\wbnh"" (UID: 00000000-00000816)56:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///4/////////////3/////3h/////////////93j//4d4b/j/h4//+HiI//Znf/+GaEeAj3SP//BERIh2ZkiGd3iHgIhEj//wb//4eHdHRneEd4SARI938G//+HdISEeEiHeAQER2BHBv//h3h0hGh0d3gGdEQEREb//4d3SEaEiHd4B4dERkREiI+Hd4R/+Ed3eARERG+ERERIh3dG//+Hd2cERmf/+HZER3d3j/////+ERH//////9ER/////////gER/92Znj/dEf////////4BEf4eIiH/3RG////////gERI+I//9/90RH//////+GBEj/hv//SP90RH//////AESP/wCP9wb/90RH/////wRI//92//hI//9kRv////8ESP///4iP////dEb/////BEj///8gB////3BG////gAREf//3AgL///cEREj//4BHRH//+AAH///3RERI//+EaER///+Hf///9kaESP//gI+Ef/////////dv90j//4f/+P/4J4+IJ//4j///////////+CIiIif////////////////3d3eP/////////////4////////+I//////////gieP////iCJ///////////giJ3d3dyIo////////////+HeiIid4////////////////h3eP////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==57:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///4/////////////3/////3h/////////////93j//4d4b/j/h4//+HiI//Znf/+GaEeAj3SP//BERIh2ZkiGd3iHgIhEj//wb//4eHdHRneEd4SARI938G//+HdISEeEiHeAQER2BHBv//h3h0hGh0d3gGdEQEREb//4d3SEaEiHd4B4dERkREiI+Hd4R/+Ed3eARERG+ERERIh3dG//+Hd2cERmf/+HZER3d3j/////+ERH//////9ER/////////gER/92Znj/dEf////////4BEf4eIiH/3RG////////gERI+I//9/90RH//////+GBEj/hv//SP90RH//////AESP/wCP9wb/90RH/////wRI//92//hI//9kRv////8ESP///4iP////dEb/////BEj///8gB////3BG////gAREf//3AgL///cEREj//4BHRH//+AAH///3RERI//+EaER///+Hf///9kaESP//gI+Ef/////////dv90j//4f/+P/4J4+IJ//4j///////////+CIiIif////////////////3d3eP/////////////4////////+I//////////gieP////iCJ///////////giJ3d3dyIo////////////+HeiIid4////////////////h3eP////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///4/////////////3/////3h/////////////93j//4d4b/j/h4//+HiI//Znf/+GaEeAj3SP//BERIh2ZkiGd3iHgIhEj//wb//4eHdHRneEd4SARI938G//+HdISEeEiHeAQER2BHBv//h3h0hGh0d3gGdEQEREb//4d3SEaEiHd4B4dERkREiI+Hd4R/+Ed3eARERG+ERERIh3dG//+Hd2cERmf/+HZER3d3j/////+ERH//////9ER/////////gER/92Znj/dEf////////4BEf4eIiH/3RG////////gERI+I//9/90RH//////+GBEj/hv//SP90RH//////AESP/wCP9wb/90RH/////wRI//92//hI//9kRv////8ESP///4iP////dEb/////BEj///8gB////3BG////gAREf//3AgL///cEREj//4BHRH//+AAH///3RERI//+EaER///+Hf///9kaESP//gI+Ef/////////dv90j//4f/+P/4J4+IJ//4j///////////+CIiIif////////////////3d3eP/////////////4////////+I//////////gieP////iCJ///////////giJ3d3dyIo////////////+HeiIid4////////////////h3eP////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///4/////////////3/////3h/////////////93j//4d4b/j/h4//+HiI//Znf/+GaEeAj3SP//BERIh2ZkiGd3iHgIhEj//wb//4eHdHRneEd4SARI938G//+HdISEeEiHeAQER2BHBv//h3h0hGh0d3gGdEQEREb//4d3SEaEiHd4B4dERkREiI+Hd4R/+Ed3eARERG+ERERIh3dG//+Hd2cERmf/+HZER3d3j/////+ERH//////9ER/////////gER/92Znj/dEf////////4BEf4eIiH/3RG////////gERI+I//9/90RH//////+GBEj/hv//SP90RH//////AESP/wCP9wb/90RH/////wRI//92//hI//9kRv////8ESP///4iP////dEb/////BEj///8gB////3BG////gAREf//3AgL///cEREj//4BHRH//+AAH///3RERI//+EaER///+Hf///9kaESP//gI+Ef/////////dv90j//4f/+P/4J4+IJ//4j///////////+CIiIif////////////////3d3eP/////////////4////////+I//////////gieP////iCJ///////////giJ3d3dyIo////////////+HeiIid4////////////////h3eP////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///4/////////////3/////3h/////////////93j//4d4b/j/h4//+HiI//Znf/+GaEeAj3SP//BERIh2ZkiGd3iHgIhEj//wb//4eHdHRneEd4SARI938G//+HdISEeEiHeAQER2BHBv//h3h0hGh0d3gGdEQEREb//4d3SEaEiHd4B4dERkREiI+Hd4R/+Ed3eARERG+ERERIh3dG//+Hd2cERmf/+HZER3d3j/////+ERH//////9ER/////////gER/92Znj/dEf////////4BEf4eIiH/3RG////////gERI+I//9/90RH//////+GBEj/hv//SP90RH//////AESP/wCP9wb/90RH/////wRI//92//hI//9kRv////8ESP///4iP////dEb/////BEj///8gB////3BG////gAREf//3AgL///cEREj//4BHRH//+AAH///3RERI//+EaER///+Hf///9kaESP//gI+Ef/////////dv90j//4f/+P/4J4+IJ//4j///////////+CIiIif////////////////3d3eP/////////////4////////+I//////////gieP////iCJ///////////giJ3d3dyIo////////////+HeiIid4////////////////h3eP////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790898124283,"unified_at":"2026-10-01T23:42:04.283Z","metadata":{"hashes":{"sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","sha1":"ad29b138883d7906f8d6e75f2e5f60e5285d4a56","md5":"86000b0a976dc4a377b2e5192fe30445","sha512":"4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19","ssdeep":"98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U","ssdeep_chunks":["98304:nUyJF2o","98304:UyJF2oY","98304:yJF2oYG","98304:JF2oYGC","98304:F2oYGCL","98304:2oYGCLx","98304:oYGCLxn","98304:YGCLxnJ","98304:GCLxnJ7","98304:CLxnJ7r","98304:LxnJ7rz","98304:xnJ7rzd","98304:nJ7rzdI","98304:J7rzdIz","98304:7rzdIzY","98304:rzdIzYs","98304:zdIzYsu","98304:dIzYsuv","98304:IzYsuvq","98304:zYsuvqq","98304:YsuvqqW","98304:suvqqW0","98304:uvqqW07","98304:vqqW07L","98304:qqW07Ls","98304:qW07Lsl","98304:W07Lsls","98304:07LslsP","98304:7LslsPT","98304:LslsPTU","196608:nUyJF2o","196608:UyJF2oY","196608:yJF2oYG","196608:JF2oYGC","196608:F2oYGCL","196608:2oYGCLx","196608:oYGCLxn","196608:YGCLxnJ","196608:GCLxnJ7","196608:CLxnJ7r","196608:LxnJ7rz","196608:xnJ7rzd","196608:nJ7rzdI","196608:J7rzdIz","196608:7rzdIzY","196608:rzdIzYs","196608:zdIzYsu","196608:dIzYsuv","196608:IzYsuvq","196608:zYsuvqq","196608:YsuvqqW","196608:suvqqW0","196608:uvqqW07","196608:vqqW07L","196608:qqW07Ls","196608:qW07Lsl","196608:W07Lsls","196608:07LslsP","196608:7LslsPT","196608:LslsPTU","98304:nUbn5zS","98304:Ubn5zSz","98304:bn5zSzY","98304:n5zSzYh","98304:5zSzYhq","98304:zSzYhqq","98304:SzYhqqW","98304:zYhqqW0","98304:YhqqW0n","98304:hqqW0ns","98304:qqW0ns8","98304:qW0ns8U"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-31371552795824764","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3992576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1679080767000,"last_seen":1679095615000,"last_multi_scan":1679095615000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":154,"suspicious_count":21,"malicious_count":11,"total":186},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AHUA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains reference to Windows native API (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to start a process"},{"type":"informative","value":"Contains ability to execute application"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Found Windows API related strings"},{"type":"informative","value":"Contains ability to create files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to modify process thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to update the user profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"informative","value":"Contains ability to start/interact with device drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to create thread in the virtual address space of another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to write data into process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to free a loaded DLL module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to unmaps a view of a section from the process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify the virtual address space of a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Found debugger evasion api strings"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the cryptographic module DLL"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/open registry keys (API string)"},{"type":"informative","value":"Contains ability to modify/delete registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime"},{"type":"informative","value":"Contains ability to load content into memory"},{"type":"informative","value":"Contains ability to decrypt message (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials from the users credential set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve local/system time as file time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains the ability to enumerate system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Tries to copy files"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Imports Crypto related APIs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match - AES Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00003508)\n \"zsBrgGjP.exe\" called \"LoadResource\" (UID: 00000000-00002884)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create thread in the virtual address space of another process (API string)","description":"Observed string:\"CreateRemoteThread\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Observed string: \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"SleepEx\" (Indicator: \"SleepEx\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to free a loaded DLL module (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00002752-00000C1E-16070519\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcessToken\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed function \"ResourceManager.GetObject\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function \"MemoryStream\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed function \"MemoryStream\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify the virtual address space of a process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Observed string: \"CallWindowProcA\" (Indicator: \"CallWindowProc\") in Source: 00000000-00000488-00000C1E-103053060","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmaps a view of a section from the process (API string)","description":"Observed string:\"NtUnmapViewOfSection\" [Source: 00000000-00002884-00000C1E-132710515]","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write data into process memory (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"wbnh.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetMethodImplementationFlags\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetMethodFromHandle\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"wbnh.exe\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetMethodImplementationFlags\" in \"wbnh.exe\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetMethodFromHandle\" in \"wbnh.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin has big resource with name: \"miAeec\" size: \"3943425\" and abnormal entropy:\"7.99994579037\"\n wbnh.exe has big resource with name: \"miAeec\" size: \"3943425\" and abnormal entropy:\"7.99994579037\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed string:\"SetUnhandledExceptionFilter\" [Source: 00000000-00002884-00000C1E-130702967]\n Observed string:\"UnhandledExceptionFilter\" [Source: 00000000-00002884-00000C1E-130701644]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: 00000000-00003152-00000C1E-42156832]\n Observed string:\"OutputDebugString\" [Source: 00000000-00000488-00000C1E-102298571]\n Observed string:\"OutputDebugString\" [Source: 00000000-00000488-00000C1E-102261446]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed string:\"frombase64string\" [Source: 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"FromBase64String\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed function \"FromBase64String\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt message (API string)","description":"Observed string: \"DecryptMessage\" (Indicator: \"DecryptMessage\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Observed string: \"EncryptMessage\" (Indicator: \"EncryptMessage\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Observed string:\"CryptUnprotectData\" which can perform decryption and does an integrity check of the data. [Source: 00000000-00000488-00000C1E-102590812]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-238","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed string:\"CryptProtectData\" which can performs encryption on the data. [Source: 00000000-00000488-00000C1E-104742709]\n Observed string:\"CryptProtectData\" which can performs encryption on the data. [Source: 00000000-00000488.00000000.77883.10226000.00000004.mdmp\n 00000000-00000488.00000001.78557.10226000.00000004.mdmp]\n Observed string:\"description=\"Uses CryptProtectData and CryptUnPr%\" which can performs encryption on the data. [Source: 00000000-00002312.00000000.76354.002C0000.00000004.mdmp\n 00000000-00002312.00000001.76456.002C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.DESCryptoServiceProvider\" and TypeReference \".ctor\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Security.Cryptography.DESCryptoServiceProvider\" and TypeReference \".ctor\" in \"wbnh.exe\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"wbnh.exe\"\n Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptProtectData\" which can \"performs encryption on the data\" [Source: Unknown.dll]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00003508)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"2752\" - (UID: 00000000-00002752)\n \".exe\" called \"IsWow64Process\" with parameter \"3508\" - (UID: 00000000-00003508)\n \".exe\" called \"IsWow64Process\" (UID: 00000000-00003508)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" (UID: 00000000-00003508)\n \".exe\" called \"GetWindowTextW\" with parameter \"Program Manager\" - (UID: 00000000-00003508)\n \".exe\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00003508)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002752)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002752)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"schtasks.exe\" called \"LookupAccountSidW\" (UID: 00000000-00001404)\n \"schtasks.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002084)\n \"schtasks.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002248)\n \"schtasks.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002444)\n \"schtasks.exe\" called \"LookupAccountSidW\" (UID: 00000000-00003932)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" (UID: 00000000-00002752)\n \".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003508)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003152)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Observed API string: \"SetupDiGetClassDevsW\" which can detect virtual environments. (Indicator: \"SetupDiGetClassDevs\") in Source: 00000000-00003508-00000C1E-43623348","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Observed string:\"GetDiskFreeSpaceA\" [Source: 00000000-00000488-00000C1E-102263385]\n Observed string:\"GetDiskFreeSpaceW\" [Source: 00000000-00000488-00000C1E-102299545]\n Observed string:\"GetDiskFreeSpaceW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"GlobalMemoryStatusEx\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"schtasks.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"wbnh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"wbnh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local/system time as file time (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00000488-00000C1E-102408547\n Observed string: \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Observed string: \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\") in Source: 00000000-00000488-00000C1E-102485580","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Observed api: \"GetUserDefaultUILanguage\"[Source: 00000000-00000488-00000C1E-102341908]\n Observed api: \"GetSystemDefaultUILanguage\"[Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string: \"GetStartupInfo\" [Source: 00000000-00002884-00000C1E-130717268]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Observed string:\"GetVolumeInformation\" [Source: 00000000-00000488-00000C1E-102490610]\n Observed string:\"GetVolumeInformation\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe\" at 00000000-00002752-0000010C-1171808\n \"cmd.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wbnh\\wbnh.exe\" at 00000000-00003656-0000010C-4806609\n \"wbnh.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wbnh\\wbnh.exe\" at 00000000-00003148-0000010C-26153497\n \"wbnh.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wbnh\\wbnh.exe\" at 00000000-00003096-0000010C-1835922\n \"wbnh.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wbnh\\wbnh.exe\" at 00000000-00001420-0000010C-1734957\n \"wbnh.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wbnh\\wbnh.exe\" at 00000000-00002312-0000010C-1684401","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbnh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wbnh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" (UID: 00000000-00002752)\n \".exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\1868f947 (UID: 00000000-00003508)\n \"cmd.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\wbnh (UID: 00000000-00003552)\n \"cmd.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\wbnh (UID: 00000000-00001928)\n \"cmd.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\wbnh (UID: 00000000-00002556)\n \"cmd.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\wbnh (UID: 00000000-00001900)\n \"zsBrgGjP.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\External\\ (UID: 00000000-00002884)\n \"zsBrgGjP.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\External\\ComponentsExt\\ (UID: 00000000-00002884)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Observed string: \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to create files (API string)","description":"Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00000488-00000C1E-102484593\n Observed string: \"CreateFileMappingA\" (Indicator: \"CreateFile\") in Source: 00000000-00000488-00000C1E-102483620\n Observed string: \"CreateFileMappingW\" (Indicator: \"CreateFile\") in Source: 00000000-00000488-00000C1E-102249718\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00002884-00000C1E-130663313\n Observed string: \"CreateFileW\" (Indicator: \"CreateFile\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"CreateFileA\" (Indicator: \"CreateFile\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to create/open registry keys (API string)","description":"Observed string: \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\") in Source: 00000000-00000488-00000C1E-102573921\n Observed string: \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Unknown.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: nss3.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Observed string: \"set_UseShellExecute\" (Indicator: \"ShellExecute\") in Source: 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\n Observed string: \"ShellExecuteA\" (Indicator: \"ShellExecute\") in Source: 00000000-00000488-00000C1E-102972984\n Observed string: \"ShellExecuteW\" (Indicator: \"ShellExecute\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"ShellExecuteA\" (Indicator: \"ShellExecute\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"ShellExecuteExW\" (Indicator: \"ShellExecute\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"WinExec\" (Indicator: \"WinExec\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to execute application","description":"Observed function \"set_UseShellExecute\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed function \"set_UseShellExecute\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to modify process thread functionality (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Observed string: \"MoveFileExW\" (Indicator: \"MoveFile\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Observed string: \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\") in Source: 00000000-00004044-00000C1E-34354896\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00002884-00000C1E-130752804\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00002884-00000C1E-130643230\n Observed string: \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"GetCommandLineW\" (Indicator: \"GetCommandLine\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"GetCommandLineA\" (Indicator: \"GetCommandLine\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Observed string: \"GetProcessHeap\" (Indicator: \"GetProcessHeap\") in Source: 00000000-00002884-00000C1E-130756935\n Observed string: \"OpenProcess\" (Indicator: \"OpenProcess\") in Source: 00000000-00000488-00000C1E-102458600\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00002752-00000C1E-16070519\n Observed string: \"OpenProcessToken\" (Indicator: \"OpenProcess\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"GetProcessHeap\" (Indicator: \"GetProcessHeap\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"OpenProcess\" (Indicator: \"OpenProcess\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00002884-00000C1E-130656992\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00002884-00000C1E-130673446\n Observed string: \"GetLastError\" (Indicator: \"GetLastError\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"SetLastError\" (Indicator: \"SetLastError\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00000488-00000C1E-103036071\n Observed string: \"ShowWindow\" (Indicator: \"ShowWindow\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function \"Process.Start\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed function \"Process.set_StartInfo\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed function \"Process.Start\" in \"wbnh.exe\"\n Observed function \"Process.set_StartInfo\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Observed string: \"StartServiceW\" (Indicator: \"StartService\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains ability to start/interact with device drivers (API string)","description":"Observed string: \"DeviceIoControl\" (Indicator: \"DeviceIoControl\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.006","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$35","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains reference to Windows native API (API string)","description":"Observed string:\"CloseHandle\" that closes an open object handle. [Source: 00000000-00002752-00000C1E-19136826]\n Observed string:\"CreateFileA\" that creates/opens a file or I/O device. [Source: 00000000-00000488-00000C1E-102484593]\n Observed string:\"CreateFileMappingA\" that creates/opens a file or I/O device. [Source: 00000000-00000488-00000C1E-102483620]\n Observed string:\"CreateFileMappingW\" that creates/opens a file or I/O device. [Source: 00000000-00000488-00000C1E-102249718]\n Observed string:\"CreateFileW\" that creates/opens a file or I/O device. [Source: 00000000-00002884-00000C1E-130663313]\n Observed string:\"LoadResource\" that retrieves a resource handle. [Source: 00000000-00002884-00000C1E-130647386]\n Observed string:\"ReadFile\" that reads data from a file or I/O device. [Source: 00000000-00002884-00000C1E-130736669]\n Observed string:\"SortCloseHandle\" that closes an open object handle. [Source: 00000000-00002752-00000C1E-17080292]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate system service (API string)","description":"Observed string:\"QueryServiceStatusEx\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"EnumServicesStatusW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"OpenServiceW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"OpenSCManagerW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__\"\n \"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Local\\__DDrawExclMode__\"\n \"8bc790b3aa117a5d47fda3ee483fb1e9\"\n \"AMResourceMutex3\"\n \"Local\\__DDrawCheckExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\AMResourceMutex3\"\n \"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\8bc790b3aa117a5d47fda3ee483fb1e9\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$36","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"$37","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"User-Agent: %s\" (Indicator: \"user-agent: \")\" in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 71f20000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 75a90000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"SHLWAPI.DLL\" at base 77860000\n \".exe\" loaded module \"VERSION.DLL\" at base 74b50000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\CLR.DLL\" at base 68b60000\n \".exe\" loaded module \"API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL\" at base 0\n \".exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL\" at base 0\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREE.DLL\" at base 0\n \".exe\" loaded module \"MSCOREE.DLL\" at base 6d430000\n \".exe\" loaded module \"PSAPI.DLL\" at base 77830000\n \".exe\" loaded module \"KERNEL32.DLL\" at base 75a90000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67750000\n \"cmd.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67580000\n \"wbnh.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67580000\n \"wbnh.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66DD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68B60000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 683B0000\n \"cmd.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 681E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68990000\n \"wbnh.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68990000\n \"wbnh.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 681E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 759E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 759E0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 759E0000\n \"wbnh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 759E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74CB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"100011000e03476d@ADVAPI32.dll\"\n \"0d000e002203476d@ADVAPI32.dll\"\n \"0d000e00fe02476d@ADVAPI32.dll\"\n \"0b000c00cc02476d@ADVAPI32.dll\"\n \"10001100da02476d@ADVAPI32.dll\"\n \"150016002c7a416d@ADVAPI32.dll\"\n \"0e000f00a47a416d@ADVAPI32.dll\"\n \"0e000f00d87a416d@ADVAPI32.dll\"\n \"11001200387f416d@ADVAPI32.dll\"\n \"11001200a47f416d@ADVAPI32.dll\"\n \"12001300b87f416d@ADVAPI32.dll\"\n \"12001300e07f416d@ADVAPI32.dll\"\n \"140015009493416d@ADVAPI32.dll\"\n \"1b001c00381f2e6d@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Filter Mapper2\" (Path: \"HKCU\\CLSID\\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}\")\n \".exe\" touched \"Filter Graph\" (Path: \"HKCU\\CLSID\\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\\TREATAS\")\n \".exe\" touched \"Capture Graph Builder 2\" (Path: \"HKCU\\CLSID\\{BF87B6E1-8C27-11D0-B3F0-00AA003761C5}\\TREATAS\")\n \".exe\" touched \"System Device Enumerator\" (Path: \"HKCU\\CLSID\\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\\TREATAS\")\n \".exe\" touched \"VFW Capture Class Manager\" (Path: \"HKCU\\CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\\TREATAS\")\n \"schtasks.exe\" touched \"TaskScheduler class\" (Path: \"HKCU\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")\n \"wbnh.exe\" touched \"DirectSound Audio Renderer\" (Path: \"HKCU\\CLSID\\{79376820-07D0-11CF-A24D-0020AFD79767}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$38","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"freebl3.dll\" has an writable section named \".data\"\n \"softokn3.dll\" has an writable section named \".data\"\n \"vcruntime140.dll\" has an writable section named \".data\"\n \"msvcp140.dll\" has an writable section named \".data\"\n \"msvcp140.dll\" has an writable section named \".didat\"\n \"Unknown.dll\" has an writable section named \"\"\n \"Unknown.dll\" has an writable section named \".rsrc\"\n \"nss3.dll\" has an writable section named \".data\"\n \"mozglue.dll\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x3ca600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x3ca453\" greater than 0x100000\n Virtual size of \"\" is \"0x161000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$3b","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"cmd.exe\" with commandline \"\"cmd\" /c copy \"C:\\\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe\" \"%APPDATA%\\\\wbnh\\\\wbnh.exe\"\" (UID: 00000000-00003656)\n Process \"cmd.exe\" with commandline \"\"cmd\" /c copy \"%APPDATA%\\\\wbnh\\\\wbnh.exe\" \"%APPDATA%\\\\wbnh\\\\wbnh.exe\"\" (UID: 00000000-00004048)\n Process \"cmd.exe\" with commandline \"\"cmd\" /c copy \"%APPDATA%\\\\wbnh\\\\wbnh.exe\" \"%APPDATA%\\\\wbnh\\\\wbnh.exe\"\" (UID: 00000000-00002524)\n Process \"cmd.exe\" with commandline \"\"cmd\" /c copy \"%APPDATA%\\\\wbnh\\\\wbnh.exe\" \"%APPDATA%\\\\wbnh\\\\wbnh.exe\"\" (UID: 00000000-00003568)\n Process \"cmd.exe\" with commandline \"\"cmd\" /c copy \"%APPDATA%\\\\wbnh\\\\wbnh.exe\" \"%APPDATA%\\\\wbnh\\\\wbnh.exe\"\" (UID: 00000000-00002872)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"wbnh.exe\" connecting to \"\\ThemeApiPort\"\n \"zsBrgGjP.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Observed string: \"QueueUserAPC\" (Indicator: \"QueueUserAPC\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"unk.xml\" has type \"XML 1.0 document text\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Observed string: \"WSASend\" (Indicator: \"WSASend\") in Source: 00000000-00003508-00000C1E-44541724\n Observed string: \"WSAStartup failed (%d)\" (Indicator: \"WSAStartup\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"WSARecv\" (Indicator: \"WSARecv\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"WSASend\" (Indicator: \"WSASend\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"copy\" (Indicator: \"copy\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Observed string: \"CreatePipe\" (Indicator: \"CreatePipe\") in Source: 00000000-00002752-00000C1E-19144987\n Observed string: \"CreatePipeW\" (Indicator: \"CreatePipe\") in Source: 00000000-00002752-00000C1E-19145665\n Observed string: \"CreatePipe\" (Indicator: \"CreatePipe\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Observed string: \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in \"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.bin\"\n Observed namespace \"System.Security.Cryptography\" in \"wbnh.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$43","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"# https://curl.haxx.se/docs/http-cookies.html\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003008\"\n YARA signature for AES encryption matched on process \"00000000-00002612\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003508\"\n YARA signature for RC4 encryption matched on process \"00000000-00002884\"\n YARA signature for RC4 encryption matched on process \"00000000-00002312\"\n YARA signature for RC4 encryption matched on file \"vcruntime140.dll\"\n YARA signature for RC4 encryption matched on process \"00000000-00003148\"\n YARA signature for RC4 encryption matched on process \"00000000-00002612\"\n YARA signature for RC4 encryption matched on process \"00000000-00000488\"\n YARA signature for RC4 encryption matched on file \"softokn3.dll\"\n YARA signature for RC4 encryption matched on process \"00000000-00004044\"\n YARA signature for RC4 encryption matched on process \"00000000-00001976\"\n YARA signature for RC4 encryption matched on process \"00000000-00002536\"\n YARA signature for RC4 encryption matched on process \"00000000-00003096\"\n YARA signature for RC4 encryption matched on process \"00000000-00003656\"\n YARA signature for RC4 encryption matched on process \"00000000-00001420\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string:\"SystemParametersInfoA\" [Source: 00000000-00000488-00000C1E-103080038]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003508)\n \"wbnh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00004044)\n \"wbnh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002612)\n \"wbnh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00001976)\n \"wbnh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002536)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002752)\n \".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003508)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003656)\n \"wbnh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003148)\n \"wbnh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00004044)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001536)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00004048)\n \"wbnh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003096)\n \"wbnh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002612)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001928)\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003164)\n \"wbnh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001420)\n \"wbnh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001976)\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002444)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string:\"OpenClipboard\" [Source: 00000000-00000488-00000C1E-103067233]\n Observed string:\"GetClipboardData\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"OpenClipboard\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Observed string:\"GetDriveTypeA\" [Source: 00000000-00000488-00000C1E-102465419]\n Observed string:\"GetDriveTypeA\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"GetDriveTypeW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileA\" [Source: 00000000-00000488-00000C1E-102469244]\n Observed string:\"FindNextFileA\" [Source: 00000000-00002884-00000C1E-130749944]\n Observed string:\"FindNextFileW\" [Source: 00000000-00002884-00000C1E-130666176]\n Observed string:\"FindFirstFileW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"FindNextFileW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"FindNextFileA\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed string:\"CreateToolhelp32Snapshot\" [Source: 00000000-00000488-00000C1E-102455140]\n Observed string:\"Process32First\" [Source: 00000000-00000488-00000C1E-102453853]\n Observed string:\"Process32Next\" [Source: 00000000-00000488-00000C1E-102452712]\n Observed string:\"25447335609,3060,3111,,Process32NextW,kernel32.dll,\"252:08:01.000\",RX=0,PX=0\" [Source: 00000000-00000488.00000001.78557.002B0000.00000004.mdmp]\n Observed string:\"CreateToolhelp32Snapshot\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"Process32NextW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"Process32FirstW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Observed string:\"GetLogicalDrives\" [Source: 00000000-00000488-00000C1E-102466370]\n Observed string:\"GetLogicalDriveStringsW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00002884-00000C1E-130624681\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00000488.00000000.77883.10226000.00000004.mdmp\n 00000000-00000488.00000001.78557.10226000.00000004.mdmp\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Observed string: \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Observed string:\"RtlGetVersion\" [Source: 00000000-00003508-00000C1E-23212965]\n Observed string:\"RtlGetVersion\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"41345532378,2652,3024,,RtlGetVersion,NTDLL.dll,\"252:03:13.015\",RX=0,PX=0\" [Source: 00000000-00002752.00000000.68065.00420000.00000004.mdmp\n 00000000-00002752.00000001.68085.00420000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Observed string:\"GetCurrentHwProfile\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"ExpandEnvironmentStringsA\" [Source: 00000000-00000488-00000C1E-102444945]\n Observed string:\"ExpandEnvironmentStringsForUserA\" [Source: 00000000-00000488-00000C1E-103144690]\n Observed string:\"GetNativeSystemInfo\" [Source: 00000000-00004044-00000C1E-34199276]\n Observed string:\"GetSystemInfo\" [Source: 00000000-00002884-00000C1E-130625625]\n Observed string:\"NtQuerySystemInformation\" [Source: 00000000-00003508-00000C1E-43397378]\n Observed string:\"GetNativeSystemInfo\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"GetSystemInfo\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"ExpandEnvironmentStringsA\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed string:\"GetComputerNameW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 00000000-00002884-00000C1E-130724029]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00002884-00000C1E-130629545]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Observed string:\"GetEnvironmentVariableW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Observed string: \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"getsockname() failed: %s\" (Indicator: \"getsockname\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed string:\"GetUserNameA\" [Source: 00000000-00000488-00000C1E-102562129]\n Observed string:\"GetUserNameExW\" [Source: 00000000-00003508-00000C1E-45168288]\n Observed string:\"GetUserNameW\" [Source: 00000000-00003508-00000C1E-45154377]\n Observed string:\"LookupAccountNameA\" [Source: 00000000-00000488-00000C1E-102561148]\n Observed string:\"GetUserNameW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: 00000000-00000488-00000C1E-103058359]\n Observed string:\"GetSystemMetrics\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00000488-00000C1E-102475595\n Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00002752-00000C1E-38834515\n Observed string: \"GetTickCount64\" (Indicator: \"GetTickCount\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed string:\"CreateCompatibleBitmap\" [Source: 00000000-00000488-00000C1E-102631316]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials from the users credential set (API string)","description":"Observed string:\"CredEnumerateA\" [Source: 00000000-00000488-00000C1E-102569964]","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"oftware\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\" in Source: 00000000-00000488.00000001.78557.002B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"$48","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Observed string:\"CreateProcessAsUser\" [Source: 00000000-00002752-00000C1E-40884699]\n Observed string:\"CreateProcessAsUserA\" [Source: 00000000-00002752-00000C1E-40884876]","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Observed string:\"CallNextHookEx\" [Source: 00000000-00000488-00000C1E-103058625]\n Observed string:\"SetWindowsHookExA\" [Source: 00000000-00000488-00000C1E-103058881]\n Observed string:\"UnhookWindowsHookEx\" [Source: 00000000-00000488-00000C1E-103066178]\n Observed string:\"SetWindowsHookExW\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"UnhookWindowsHookEx\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"CallNextHookEx\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.004","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string:\"AdjustTokenPrivileges\" [Source: 00000000-00003508-00000C1E-43244433]\n Observed string:\"SeShutdownPrivilege\" [Source: 00000000-00001976.00000000.75367.002B0000.00000004.mdmp]\n Observed string:\"SeShutdownPrivilege\" [Source: 00000000-00002536.00000000.76672.00080000.00000004.mdmp]\n Observed string:\"SeShutdownPrivilege\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000000.71916.00AE0000.00000004.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"SeDebugPrivilege\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]\n Observed string:\"AdjustTokenPrivileges\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00002884-00000C1E-130654175\n Observed string: \"TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: 00000000-00002884-00000C1E-130640416\n Observed string: \"CorExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"TerminateProcess\" (Indicator: \"TerminateProcess\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"wbnh.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$49","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"wbnh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00000488-00000C1E-102476697\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00002884-00000C1E-130652275\n Observed string: \"DeleteFileW\" (Indicator: \"DeleteFileW\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to modify/delete registry keys (API string)","description":"Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002752-00000C1E-15480850\n Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00000488-00000C1E-102571877\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00000488.00000000.77883.10226000.00000004.mdmp\n 00000000-00000488.00000001.78557.10226000.00000004.mdmp\n Observed string: \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp\n Observed string: \"RegCloseKey\" (Indicator: \"RegCloseKey\") in Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: 00000000-00002612.00000000.71916.009B0000.00000002.mdmp\n 00000000-00002612.00000001.71962.009B0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$4a","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"wbnh.exe\" - Location: [%APPDATA%\\wbnh\\wbnh.exe]- [targetUID: 00000000-00002524]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$4b","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.9991568804\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 2320) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"VBoxDisp.dll\" (Indicator: \"vbox\") in Source: 00000000-00003508-00000C1D-25577760","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \"wbnh.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/69 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"j2r@k.ka\"\n Pattern match: \"ftp@example.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Unknown.dll\" has resource with unusual entropy \"RT_BITMAP:7.92098421127\"\n \"Unknown.dll\" has resource with unusual entropy \"RT_ICON:7.86511050669\"\n \"Unknown.dll\" has resource with unusual entropy \"RT_ICON:7.84942230375\"\n \"Unknown.dll\" has resource with unusual entropy \"RT_ICON:7.8470612256\"\n \"Unknown.dll\" has resource with unusual entropy \"RT_ICON:7.86151008932\"\n \"Unknown.dll\" has resource with unusual entropy \"RT_ICON:7.87441985016\"\n \"Unknown.dll\" has resource with unusual entropy \"RT_DIALOG:7.6294165722\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$4c","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4d","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::GetFields(System.Reflection.BindingFlags) at 86000b0a976dc4a377b2e5192fe30445-6000042-Strings~CreateGetStringDelegate\n System.Type::GetFields(System.Reflection.BindingFlags) at 86000b0a976dc4a377b2e5192fe30445-6000040-MemberRefsProxy~CreateMemberRefsDelegates","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4e","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The analysis extracted file with a known ransomware suffix","description":"Found dropped filename \"c039198306863035fea360c1237d8088.enc\" which has been seen in the context of ransomware (Indicator: .ENC)","origin":"Binary File","mitre_attack_id":"T1491.001","relevance":10,"id":"binary-22","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\", cmd=\" (Indicator: \"cmd=\")\n \"cmd=\" (Indicator: \"cmd=\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\".exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003508)\n \"wbnh.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004044)\n \"wbnh.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002612)\n \"wbnh.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00001976)\n \"wbnh.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002536)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$50","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$51","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$52","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"api-ms-win-crt-filesystem-l1-1-0.dll\" claims program is from Tue Aug 26 11:12:21 2025\n \"api-ms-win-crt-runtime-l1-1-0.dll\" claims program is from Fri May 31 18:06:00 1974\n \"api-ms-win-crt-conio-l1-1-0_not.dll\" claims program is from Mon Oct 13 02:38:07 2059\n \"api-ms-win-crt-heap-l1-1-0.dll\" claims program is from Tue Mar 31 17:26:34 1987\n \"api-ms-win-crt-stdio-l1-1-0.dll\" claims program is from Wed Jul 13 01:51:24 2089\n \"api-ms-win-crt-utility-l1-1-0.dll\" claims program is from Sun Sep 6 09:19:26 2105\n \"api-ms-win-crt-environment-l1-1-0.dll\" claims program is from Fri Apr 21 12:19:18 1972\n \"api-ms-win-crt-math-l1-1-0.dll\" claims program is from Wed Sep 29 08:09:06 1982\n \"api-ms-win-crt-multibyte-l1-1-0.dll\" claims program is from Wed Aug 12 16:00:10 2054\n \"api-ms-win-crt-convert-l1-1-0.dll\" claims program is from Thu Apr 13 15:13:55 2073","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"-a \"%LOCALAPPDATA%\\1868f947\\plg\\zsBrgGjP.json\"\" - (UID: 00000000-00003508)\n \"zsBrgGjP.exe\" called \"CreateProcessW\" with parameter \"-a \"%TEMP%\\unk.xml\"\" - (UID: 00000000-00002884)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\".exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe\", which might be an injection preparation attempt ..., \".exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\zsBrgGjP.exe\"\n which might be an injection preparation attempt ...\n \"wbnh.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wbnh\\wbnh.exe\", which might be an injection preparation attempt ..., \"zsBrgGjP.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\zsBrgGjP.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/69 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"36/71 Antivirus vendors marked dropped file \"Unknown.dll\" as malicious (classified as \"Trojan.Redcap\" with 50% detection rate)\n 24/68 Antivirus vendors marked dropped file \"zsBrgGjP.exe\" as malicious (classified as \"VHO:Trojan\" with 35% detection rate)\n 33/69 Antivirus vendors marked dropped file \"wbnh.exe\" as malicious (classified as \"Trojan.Z.Kryptik\" with 47% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$54","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$55","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"The analysis extracted file with a known ransomware suffix"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Found a Wine emulator related string"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}]},"activity":{"stats":{"process_count":35,"spawned_processes_count":35,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":102,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":24,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6414f37b301871ad9004f191","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Z.Kryptik","submit_name":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","analysis_start_time":"2023-03-17T23:10:52+00:00","indicators_count":{"informative":154,"suspicious":43,"malicious":14},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}],"processes":[{"pid":2752,"ppid":0,"name":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","uid":"00000000-00002752","icon":"$56"},{"pid":3508,"ppid":2752,"name":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","parent_uid":"00000000-00002752","uid":"00000000-00003508"},{"pid":3928,"ppid":3508,"name":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","command_line":"-a \"%LOCALAPPDATA%\\1868f947\\plg\\zsBrgGjP.json\"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe","parent_uid":"00000000-00003508","uid":"00000000-00003928"},{"pid":2884,"ppid":3508,"name":"zsBrgGjP.exe","command_line":"-a \"%LOCALAPPDATA%\\1868f947\\plg\\zsBrgGjP.json\"","sha256":"63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade","normalized_path":"%TEMP%\\zsBrgGjP.exe","parent_uid":"00000000-00003508","uid":"00000000-00002884"},{"pid":488,"ppid":2884,"name":"zsBrgGjP.exe","command_line":"-a \"%TEMP%\\unk.xml\"","sha256":"63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade","normalized_path":"%TEMP%\\zsBrgGjP.exe","parent_uid":"00000000-00002884","uid":"00000000-00000488"},{"pid":2864,"ppid":2752,"name":"cmd.exe","command_line":"\"cmd\" /c mkdir \"%APPDATA%\\wbnh\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002752","uid":"00000000-00002864"},{"pid":3152,"ppid":2752,"name":"cmd.exe","command_line":"\"cmd\" /c schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002752","uid":"00000000-00003152"},{"pid":1404,"ppid":3152,"name":"schtasks.exe","command_line":"schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003152","uid":"00000000-00001404"},{"pid":3656,"ppid":2752,"name":"cmd.exe","command_line":"\"cmd\" /c copy \"C:\\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe\" \"%APPDATA%\\wbnh\\wbnh.exe\"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002752","uid":"00000000-00003656"},{"pid":3008,"ppid":3656,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","parent_uid":"00000000-00003656","uid":"00000000-00003008"},{"pid":816,"ppid":3656,"name":"cmd.exe","command_line":"\"cmd\" /c mkdir \"%APPDATA%\\wbnh\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003656","uid":"00000000-00000816"},{"pid":3148,"ppid":0,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","uid":"00000000-00003148","icon":"$57"},{"pid":4044,"ppid":3148,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","parent_uid":"00000000-00003148","uid":"00000000-00004044"},{"pid":3552,"ppid":3148,"name":"cmd.exe","command_line":"\"cmd\" /c mkdir \"%APPDATA%\\wbnh\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003148","uid":"00000000-00003552"},{"pid":1536,"ppid":3148,"name":"cmd.exe","command_line":"\"cmd\" /c schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003148","uid":"00000000-00001536"},{"pid":2084,"ppid":1536,"name":"schtasks.exe","command_line":"schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00001536","uid":"00000000-00002084"},{"pid":4048,"ppid":3148,"name":"cmd.exe","command_line":"\"cmd\" /c copy \"%APPDATA%\\wbnh\\wbnh.exe\" \"%APPDATA%\\wbnh\\wbnh.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003148","uid":"00000000-00004048"},{"pid":3096,"ppid":0,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","uid":"00000000-00003096","icon":"$58"},{"pid":2612,"ppid":3096,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","parent_uid":"00000000-00003096","uid":"00000000-00002612"},{"pid":1928,"ppid":3096,"name":"cmd.exe","command_line":"\"cmd\" /c mkdir \"%APPDATA%\\wbnh\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003096","uid":"00000000-00001928"},{"pid":3164,"ppid":3096,"name":"cmd.exe","command_line":"\"cmd\" /c schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003096","uid":"00000000-00003164"},{"pid":2248,"ppid":3164,"name":"schtasks.exe","command_line":"schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00003164","uid":"00000000-00002248"},{"pid":2524,"ppid":3096,"name":"cmd.exe","command_line":"\"cmd\" /c copy \"%APPDATA%\\wbnh\\wbnh.exe\" \"%APPDATA%\\wbnh\\wbnh.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003096","uid":"00000000-00002524"},{"pid":1420,"ppid":0,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","uid":"00000000-00001420","icon":"$59"},{"pid":1976,"ppid":1420,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","parent_uid":"00000000-00001420","uid":"00000000-00001976"},{"pid":2556,"ppid":1420,"name":"cmd.exe","command_line":"\"cmd\" /c mkdir \"%APPDATA%\\wbnh\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001420","uid":"00000000-00002556"},{"pid":2452,"ppid":1420,"name":"cmd.exe","command_line":"\"cmd\" /c schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001420","uid":"00000000-00002452"},{"pid":2444,"ppid":2452,"name":"schtasks.exe","command_line":"schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002452","uid":"00000000-00002444"},{"pid":3568,"ppid":1420,"name":"cmd.exe","command_line":"\"cmd\" /c copy \"%APPDATA%\\wbnh\\wbnh.exe\" \"%APPDATA%\\wbnh\\wbnh.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00001420","uid":"00000000-00003568"},{"pid":2312,"ppid":0,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","uid":"00000000-00002312","icon":"$5a"},{"pid":2536,"ppid":2312,"name":"wbnh.exe","command_line":"","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","normalized_path":"%APPDATA%\\wbnh\\wbnh.exe","parent_uid":"00000000-00002312","uid":"00000000-00002536"},{"pid":1900,"ppid":2312,"name":"cmd.exe","command_line":"\"cmd\" /c mkdir \"%APPDATA%\\wbnh\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002312","uid":"00000000-00001900"},{"pid":2896,"ppid":2312,"name":"cmd.exe","command_line":"\"cmd\" /c schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002312","uid":"00000000-00002896"},{"pid":3932,"ppid":2896,"name":"schtasks.exe","command_line":"schtasks /create /sc minute /mo 1 /tn \"Nafifas\" /tr \"'%APPDATA%\\wbnh\\wbnh.exe'\" /f","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00002896","uid":"00000000-00003932"},{"pid":2872,"ppid":2312,"name":"cmd.exe","command_line":"\"cmd\" /c copy \"%APPDATA%\\wbnh\\wbnh.exe\" \"%APPDATA%\\wbnh\\wbnh.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002312","uid":"00000000-00002872"}],"all_imported_dlls":["ntdll.dll","shell32.dll","KernelBase.dll","wshqos.dll","sspicli.dll","ucrtbase_clr0400.dll","devenum.dll","profapi.dll","mscorlib.ni.dll","msvfw32.dll","msdmo.dll","bcryptprimitives.dll","webio.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Drawing.ni.dll","System.Management.ni.dll","clbcatq.dll","credssp.dll","atl.dll","bcrypt.dll","dnsapi.dll","wlanapi.dll","oleacc.dll","pstorec.dll","gdi32.dll","msvcrt.dll","vcruntime140_clr0400.dll","System.ni.dll","uxtheme.dll","comctl32.dll","msasn1.dll","wlanutil.dll","clr.dll","apphelp.dll","kernel32.dll","version.dll","crypt32.dll","msimg32.dll","IPHLPAPI.DLL","nlssorting.dll","dwmapi.dll","oleaut32.dll","imm32.dll","shlwapi.dll","psapi.dll","Wldap32.dll","FWPUCLNT.DLL","sechost.dll","pnrpnsp.dll","quartz.dll","ntmarta.dll","WSHTCPIP.DLL","d3d9.dll","tzres.dll","taskschd.dll","rpcss.dll","advapi32.dll","rpcrt4.dll","cryptsp.dll","GdiPlus.dll","setupapi.dll","devobj.dll","rasadhlp.dll","winhttp.dll","nsi.dll","System.Core.ni.dll","qcap.dll","winnsi.dll","rasman.dll","winbrand.dll","lpk.dll","msctf.dll","mscoree.dll","fltLib.dll","nlaapi.dll","winmm.dll","oleaccrc.dll","Unknown.dll","winrnr.dll","powrprof.dll","ole32.dll","ws2_32.dll","cryptbase.dll","wintrust.dll","wship6.dll","ktmw32.dll","api-ms-win-core-synch-l1-2-0.dll","mscoreei.dll","clrjit.dll","System.Windows.Forms.ni.dll","avicap32.dll","NapiNSP.dll","d3d8thk.dll","userenv.dll","mswsock.dll","user32.dll","usp10.dll","rsaenh.dll","mscorrc.dll","cfgmgr32.dll","rasapi32.dll","xmllite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"wbnh.exe","sha256":"11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Unknown.dll","sha256":"568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"zsBrgGjP.exe","sha256":"63a7295e66183379580db16d0d191bb261ccc9edb982980051291c8bdf6c4ade","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-conio-l1-1-0_not.dll","sha256":"9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-convert-l1-1-0.dll","sha256":"3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-environment-l1-1-0.dll","sha256":"c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-filesystem-l1-1-0.dll","sha256":"7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-heap-l1-1-0.dll","sha256":"f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-locale-l1-1-0.dll","sha256":"565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-math-l1-1-0.dll","sha256":"bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-multibyte-l1-1-0.dll","sha256":"66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-runtime-l1-1-0.dll","sha256":"c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-stdio-l1-1-0.dll","sha256":"b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-string-l1-1-0.dll","sha256":"73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-time-l1-1-0.dll","sha256":"69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"api-ms-win-crt-utility-l1-1-0.dll","sha256":"a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"freebl3.dll","sha256":"8e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"mozglue.dll","sha256":"4434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"msvcp140.dll","sha256":"334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"nss3.dll","sha256":"17f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"softokn3.dll","sha256":"8f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"vcruntime140.dll","sha256":"c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"c039198306863035fea360c1237d8088.enc","sha256":"25f66b5b184183841a193f137df2c46ddabd69e0ef5a9636affd40bd7cda1d89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%LOCALAPPDATA%\\17-03-2023","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%APPDATA%\\wbnh","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\License.XenArmor","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\unk.xml","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-conio-l1-1-0_not.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-convert-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-environment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-filesystem-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-locale-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-math-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-multibyte-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-runtime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-stdio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-time-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\api-ms-win-crt-utility-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\freebl3.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\mozglue.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\nss3.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\softokn3.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"path":"%TEMP%\\External\\ComponentsExt\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0002\\","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\RNG\\","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"8bc790b3aa117a5d47fda3ee483fb1e9","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\8bc790b3aa117a5d47fda3ee483fb1e9","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6414f37b301871ad9004f191"}]}]}},"report_ids":{"sandbox_job_ids":["6414f37b301871ad9004f191"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 11fa27c4961a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 11fa27c4961a…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 11fa27c4961a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 11fa27c4961a…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 11fa27c4961a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 11fa27c4961a…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 11 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]