24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Packy.Generic Sample 13cc97185f7c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 13cc97185f7c…. Malware family: MSIL.Packy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc","keywords":["Malicious","MSIL.Packy.Generic","malware analysis","sandbox report","threat intelligence","13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc"],"about":{"@type":"SoftwareApplication","name":"bounty-1032793807825411","applicationCategory":["peexe","assembly","executable"],"identifier":"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Packy.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40b,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00008028.00000000.138696.00239000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008028.00000000.138696.00239000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00008028.00000000.138696.00239000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00008028.00000000.138696.00239000.00000002.mdmp")26:T501,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt data Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)27:T10aff,Found XOR loop in file "DCRatBuild.exe" at offset 80956; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 256237; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 314655; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 315919; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 893776; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 926669; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1118582; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1140824; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1513911; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1601999; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1613828; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1617139; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1643501; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 1848992; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 2052068; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 2053740; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 2121985; code bytes = 30d0 Found XOR loop in file "DCRatBuild.exe" at offset 13753; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 13871; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 55393; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 72424; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 72700; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 126518; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 126649; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 312021; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 313023; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1111182; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1111736; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1113542; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1169960; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1283490; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1396928; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1496035; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1814786; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1842751; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1843120; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1859402; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1887080; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 1937027; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 2031892; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 2055173; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 2098442; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 2109630; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 2141112; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 2153888; code bytes = 33c1 Found XOR loop in file "DCRatBuild.exe" at offset 52821; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 62694; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 117539; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 118971; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 158082; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 314636; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 315512; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 315884; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1187608; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1262835; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1299755; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1390283; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1461012; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1578298; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1618475; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1627810; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1651797; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1680909; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1735019; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1740915; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1822255; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1939092; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 1987123; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 2044017; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 2095506; code bytes = 8030 Found XOR loop in file "DCRatBuild.exe" at offset 2106643; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "services.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "services.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "services.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "services.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "services.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "services.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "smss.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "smss.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "smss.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "ctfmon.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "ctfmon.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "ctfmon.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "TrustedInstaller.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "TrustedInstaller.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "TrustedInstaller.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "fontdrvhost.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "fontdrvhost.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "fontdrvhost.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "System.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "System.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "System.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "System.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "System.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "System.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "Memory Compression.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "Memory Compression.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "Memory Compression.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "RuntimeBroker.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "RuntimeBroker.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "RuntimeBroker.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "backgroundTaskHost.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "backgroundTaskHost.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "backgroundTaskHost.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "taskhostw.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "taskhostw.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "taskhostw.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "ComContainer.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "ComContainer.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "ComContainer.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 577042; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 609935; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 801848; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 824090; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1197177; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1285265; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1297094; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1300405; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1326767; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1532258; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1735334; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1737006; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 1805251; code bytes = 30d0 Found XOR loop in file "lsass.exe" at offset 794448; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 795002; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 796808; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 853226; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 966756; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1080194; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1179301; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1498052; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1526017; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1526386; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1542668; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1570346; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1620293; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1715158; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1738439; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1781708; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1792896; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1824378; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 1837154; code bytes = 33c1 Found XOR loop in file "lsass.exe" at offset 870874; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 946101; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 983021; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1073549; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1144278; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1261564; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1301741; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1311076; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1335063; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1364175; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1418285; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1424181; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1505521; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1622358; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1670389; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1727283; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1778772; code bytes = 8030 Found XOR loop in file "lsass.exe" at offset 1789909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 138699; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 172964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 291961; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 531574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 576904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 599156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 972353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1060471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1072300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1075616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1101983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1307539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1510675; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1512347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1580612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 206421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 208651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 209587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 300056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 342574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 506553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 555490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 569504; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 570058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 571864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 628297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 741862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 855335; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 954472; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1273323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1301293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1301662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1317949; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1345637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1395599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1513780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1557064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1568257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1599749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1612525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 33117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 136464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 286006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 645950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 721202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 758132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 848690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 919439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1036760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1076952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1086287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1110284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1139401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1193531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1199427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1280792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1397664; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1445710; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1502624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1554128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1565265; code bytes = 803028:T178c,"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000007d0cb9e1f68900000800000000000000ffffffffffffffff3400000000000000642fdfdffa7f000068e7b70000000000db044702fb7f000000000000fa7f00002a961efffa7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d0e7b70000000000080000000000000000000000000000000000000000000000ed12b8e1f6890000c3f04502fb7f000000006d01fb7f0000a7134602fb7f000028e8b700 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac4400fb7f0000000000000000000051ed4902fb7f0000000000000000000000000000000000003dd57fb8efd100002a000000000000005062fd02000000008fec4902fb7f0000e0ac4400fb7f0000e0ac4400fb7f0000000000000000000000000000fa7f0000ffffff7f7828000000000000000000000000000000000000d8ce3800fb7f00002a0000000000000069c3f1fffa7f0000310000000000000020030000000000002403000000000000110001100000000060cdb7000000000003a3defffa7f000060cdb7000000000000000000000000002b00000000000000000000000000000020b0f7fffa7f0000b43ff6fffa7f0000e0ce3800 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003384) "DCRatBuild.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005748) "DCRatBuild.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006400000094454f0050454f00f39b1577c0484f001c1e690064000000902f690094454f000000000078454f00977f157794454f00e99c1777c030fe730008000001013d0000000000b42f69006776ba429c454f009c454f007245e17600000000c030fe73ffffffffa6bcf8005c000000c030fe7300080000b104f90088694f00 (UID: 00000000-00005748) "DCRatBuild.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005748)29:Teef,"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000350066003700630061006100330061003600370066006200320066003200330032003500610065003200370034003100640062003700660038003800300065006500610062003100300033003700390039006300640033006100320037003400370030003500360063006300620063002e00650078006500000050ddf302 (UID: 00000000-00003384) "DCRatBuild.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000038091c000000000008e24f0059161677010000000800000001000000000069000000000010000000000000000000000002000000020000000000690001000000080000000000000028e24f00ee13167701000000ee131677080000000000000008000000d5ac784e60e44f00ad9c6572000069000800000001000000 (UID: 00000000-00005748) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000018000000e99c1777b3ea757278106f00f88b8302b0ff6f00501876726c88eab1feffffff10ff6f00be46747212000000e079220000002200ce467472feffffff0000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008028) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000ba028000000000000000f8535474e4dd6f00ee13167780000000ee131677000000000000000080000000f06249727f381ffb04de6f00507234760000ba020000000080000000f062497202000000002f497220de6f00fb6249720100000080044a72885f36760000000059ee33c950de6f00b8644972f42e4972 (UID: 00000000-00008028) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000e1b9a3030000003c3b457202000000c01a4672a0a1ba0298a1ba02dde1b9a3a0c46f003c3b45728cc56f00101046720d9b91d1feffffff321246724c124672c01a467208c56f00d47d4572c01a4672735f36760100000094cb4772885f3676c07d457271f533c938c56f00880c4672343b4572403b45720000000000000000 (UID: 00000000-00008028) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b0aa3f72bca2ba02a8a2ba026f066031f0d26f0088f64072dcd36f00809d3f72af0b4f43feffffff25a03f723fa03f72b0aa3f7258d36f001f623f72b0aa3f72735f367601000000b8f54072885f367610623f7221e333c988d36f00d8993f72f4323f7208333f72a8b6e17600000000b8b6e1761e63f73788d36f00 (UID: 00000000-00008028) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000ba028000000000000000809d3f7244d36f00ee13167780000000ee13167700000000000000008000000090734272735f367664d36f00507234760000ba02000000008000000090734272020000007033427280d36f009b73427201000000f0454372885f367600000000f9e333c9b0d36f005875427264334272 (UID: 00000000-00008028) "ComContainer.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000007300640032006a0072005c0061007000700064006100740061005c006c006f00630061006c005c00740065006d0070005c006200720069006400670065006800790070006500720062006c006f0063006b0072006500760069006500770064006800630070005c0063006f006d0063006f006e007400610069006e006500 (UID: 00000000-00002448) "ComContainer.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000006c0c4f626a65637400000000000000000000000000000000000000000000000000000000000000002014b6040000000000000000000000000300000000000000c46723dbfa7f00001000000000000000100000000000000060dd901d0000000080000000000000001000000000000000a169a8f0fa7f000000000000 (UID: 00000000-00002448) "ComContainer.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000006c0c4f626a65637400000000000000000000000000000000000000000000000000000000000000002014b6040000000000000000000000000300000000000000c46723dbfa7f000010000000000000001000000000000000d0dc901d0000000080000000000000001000000000000000a169a8f0fa7f000000000000 (UID: 00000000-00002448)2a:T828,"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "DCRatBuild.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "DCRatBuild.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ComContainer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2b:T4aa,"DCRatBuild.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "DCRatBuild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "DCRatBuild.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "DCRatBuild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ".VBE"; Value: "") "DCRatBuild.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "DCRatBuild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "DCRatBuild.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "DCRatBuild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ".VBE"; Value: "")2c:T499,"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" queries volume information of "C:\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" at 00000000-00003384-00000C17-1162154936 "ComContainer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\bridgehyperblockreviewdhcp\ComContainer.exe" at 00000000-00002448-00000C17-1178181736 "ComContainer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00002448-00000C17-1181294706 "ComContainer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00002448-00000C17-1181730465 "ComContainer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00007068-00000C17-1186949750 "ComContainer.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00007068-00000C17-11874454502d:T122b,"ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\Windows Defender\services.exe (UID: 00000000-00002448) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\TorService\data\fontdrvhost.exe (UID: 00000000-00002448) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\Recovery\TrustedInstaller.exe (UID: 00000000-00002448) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\tempdir\node_modules\fined\RuntimeBroker.exe (UID: 00000000-00002448) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %WINDIR%\Tasks\RuntimeBroker.exe (UID: 00000000-00002448) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\RuntimeBroker.exe (UID: 00000000-00002448) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\WindowsPowerShell\Configuration\Registration\backgroundTaskHost.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\(x86)\Java\jre1.8.0_161\bin\dtplugin\System.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\found.000\dir0009.chk\smss.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\(x86)\Microsoft\EdgeUpdate\1.3.171.37\conhost.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\TorService\tor\pluggable_transports\csrss.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\inetpub\history\CFGHISTORY_0000000001\System.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\csrss.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\inetpub\custerr\Memory Compression.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\tempdir\node_modules\pm2-sysmonit\src\Memory Compression.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\Uninstall Information\smss.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\(x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhostw.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\TorService\data\conhost.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %WINDIR%\Setup\State\fontdrvhost.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\Recovery\lsass.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %WINDIR%\Logs\dosvc\dwm.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location %PROGRAMFILES%\(x86)\windows nt\accessories\ctfmon.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\Recovery\services.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\Recovery\conhost.exe (UID: 00000000-00007068) "ComContainer.exe" called "CopyFileW" to copy %TEMP%\bridgehyperblockreviewdhcp\ComContainer.exe to new location C:\Recovery\OSPPSVC.exe (UID: 00000000-00007068)2e:T6016,"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003384) "13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003384) "DCRatBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005748) "DCRatBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005748) "DCRatBuild.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005748) "DCRatBuild.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005748) "DCRatBuild.exe" called "LoadLibrary" with a parameter nulstart \"\" \"C:\\Windows\\Setup\\State\\fontdrvhost.exe\"del /a /q /f \"C:\\Users\\DcSD2JR\\AppData\\Local\\Temp\\\\mU8k0eGfsI.bat\"\" (Indicator: \"w32tm \"; File: \"mU8k0eGfsI.bat\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"DCRatBuild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ComContainer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"ComContainer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DCRATBUILD.EXE\")\n \"DCRatBuild.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FCDPQHA3L1059HFDL7XIPA.BAT\")\n \"ComContainer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\COMCONTAINER.EXE\")\n \"ComContainer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"ComContainer.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"ComContainer.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002448)\n \"ComContainer.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$2d","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"DCRatBuild.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00005748)\n \"DCRatBuild.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\DcSD2JR (UID: 00000000-00005748)\n \"DCRatBuild.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005748)\n \"DCRatBuild.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005748)\n \"DCRatBuild.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005748)\n \"DCRatBuild.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\bridgehyperblockreviewdhcp (UID: 00000000-00005748)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\DCRatBuild.exe\"\" - (UID: 00000000-00003384)\n \"DCRatBuild.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"%TEMP%\\bridgehyperblockreviewdhcp\\JFcWz5uGBCcQNylIeBn.vbe\"\" - (UID: 00000000-00005748)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat\"\" - (UID: 00000000-00008028)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe\"\" - (UID: 00000000-00007744)\n \"ComContainer.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe\"\" - (UID: 00000000-00002448)\n \"ComContainer.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /C \"%TEMP%\\mU8k0eGfsI.bat\"\" - (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMoniker\" (Indicator: \"CreateFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"conhost.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"conhost.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"conhost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"conhost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"conhost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetCreationTimeUtc\" in \"conhost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastAccessTimeUtc\" in \"conhost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTimeUtc\" in \"conhost.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTime\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\"\n Observed function \"Process.Start\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows Script Host\\Settings\" in Source: 00000000-00008028.00000000.138696.00221000.00000020.mdmp\n \"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" in Source: 00000000-00008028.00000000.138696.00221000.00000020.mdmp\n \"SOFTWARE\\Classes\\%s\\%s\" in Source: 00000000-00008028.00000000.138696.00221000.00000020.mdmp\n \"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{0823B6F8-F499-4D5E-B88\" in Source: 00000000-00008028.00000000.138696.02820000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00008028.00000000.138696.02820000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"DCRatBuild.exe\" with parameter C:\\Users (UID: 00000000-00005748)\n \"DCRatBuild.exe\" with parameter C:\\Users\\DcSD2JR (UID: 00000000-00005748)\n \"DCRatBuild.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005748)\n \"DCRatBuild.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005748)\n \"DCRatBuild.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005748)\n \"DCRatBuild.exe\" with parameter %TEMP%\\bridgehyperblockreviewdhcp (UID: 00000000-00005748)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$30","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"conhost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"conhost.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\bridgehyperblockreviewdhcp\\\\FCDPQha3l1059hFdl7xiPA.bat\" \"\" (UID: 00000000-00007744)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"conhost.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$32","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"DCRatBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 725F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at CEED0000\n \"ComContainer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at CEED0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 725A0000\n \"ComContainer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at F6D10000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FF340000\n \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FE300000\n \"DCRatBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75410000\n \"DCRatBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72910000\n \"WScript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75410000\n \"WScript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72910000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75410000\n \"ComContainer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FF340000\n \"ComContainer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FE300000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D04D0000\n \"ComContainer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at D04D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 015B0000\n \"DCRatBuild.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75710000\n \"WScript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75710000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75710000\n \"ComContainer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 015B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c765fffa7f0000@ntdll.dll\"\n \"220023000000000018c765fffa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" was detected as \".NET\" and name: \"Library\"\n \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"conhost.exe\" was detected as \".NET\" and name: \"Library\"\n \"conhost.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"conhost.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$34","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"conhost.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" has an executable section named \".text\"\n \"conhost.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"conhost.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$35","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x18ec00\" greater than 0x100000\n Raw size of \".text\" is \"0x1c2e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x18eb14\" greater than 0x100000\n Virtual size of \".text\" is \"0x1c2d74\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$36","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$38","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"DCRatBuild.exe\" searching for class \"EDIT\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"DCRatBuild.exe\" (UID: 00000000-00005748)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\bridgehyperblockreviewdhcp\\\\JFcWz5uGBCcQNylIeBn.vbe\"\" (UID: 00000000-00008028)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\bridgehyperblockreviewd ...\" (UID: 00000000-00007744)\n Spawned process \"ComContainer.exe\" (UID: 00000000-00002448)\n Spawned process \"ComContainer.exe\" (UID: 00000000-00007068)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"DCRatBuild.exe\" (UID: 00000000-00005748)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\bridgehyperblockreviewdhcp\\\\JFcWz5uGBCcQNylIeBn.vbe\"\" (UID: 00000000-00008028)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\bridgehyperblockreviewd ...\" (UID: 00000000-00007744)\n Spawned process \"ComContainer.exe\" (UID: 00000000-00002448)\n Spawned process \"ComContainer.exe\" (UID: 00000000-00007068)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"conhost.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DCRatBuild.exe\"\n \"DCRatBuild.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat\"\n \"DCRatBuild.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\ComContainer.exe\"\n \"DCRatBuild.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\JFcWz5uGBCcQNylIeBn.vbe\"\n \"ComContainer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fd7334d078e05ec916c8ee9df749ecc31ec2ddc44.5.32e6adcc3843db4019caa6e20d92ba1ac52139104a\"\n \"ComContainer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Zs2XG1kf97\"\n \"ComContainer.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mU8k0eGfsI.bat\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$3a","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"DCRatBuild.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"ComContainer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" queries basic process information of the \"C:\\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (UID: 3384)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$44","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe.log\"\n \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe.log\"\n \"ComContainer.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\ComContainer.exe.log\"\n \"ComContainer.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\ComContainer.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \".ctor\" in \"conhost.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \".ctor\" in \"conhost.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"get_Client\" in \"conhost.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Send\" in \"conhost.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"SendTo\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"conhost.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"conhost.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"conhost.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"conhost.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"conhost.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"conhost.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_CookieContainer\" in \"conhost.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_ReadWriteTimeout\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"conhost.exe\"\n Observed namespace \"System.Net.Sockets\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"^yn.pg\"\n Heuristic match: \"y@t4.bz\"\n Heuristic match: \"i+[.jm\"\n Heuristic match: \"tp.tt\"\n Pattern match: \"http://www.validationtest.contoso.com/test%d.html\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00008028.00000000.138696.72551000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy File","description":"$45","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00008028\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00008028.00000000.138696.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"DCRatBuild.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ComContainer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"ComContainer.exe\" called \"GetComputerNameW\" (UID: 00000000-00002448)\n \"ComContainer.exe\" called \"GetComputerNameW\" (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"ComContainer.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"ComContainer.exe\" called \"GetUserNameW\" (UID: 00000000-00002448)\n \"ComContainer.exe\" called \"GetUserNameW\" (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"27d1bcfc3c54e0\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00008028.00000000.138696.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"conhost.exe\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1056.001","relevance":1,"id":"static-163","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"conhost.exe\"\n Observed function \"get_ProcessName\" in \"conhost.exe\"\n Observed function \"GetProcessesByName\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00008028.00000000.138696.72551000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"DCRatBuild.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003384-00000C2B-1161467555\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002448-00000C2B-1179040354\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002448-00000C2B-1179428819\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002448-00000C2B-1179428849\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"ComContainer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002448)\n \"ComContainer.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00008028.00000000.138696.02820000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart \"\" \"C:\\Windows\\Setup\\State\\fontdrvhost.exe\"del /a /q /f \"C:\\Users\\DcSD2JR\\AppData\\Local\\Temp\\\\mU8k0eGfsI.bat\"\" (Indicator: \"\"del \") in Source: mU8k0eGfsI.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00008028.00000000.138696.72551000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00008028.00000000.138696.72551000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008028.00000000.138696.00239000.00000002.mdmp, 00000000-00008028.00000000.138696.72565000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ComContainer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"945167FCCF11DC0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" opened \"\\Device\\KsecDD\"\n \"DCRatBuild.exe\" opened \"\\Device\\KsecDD\"\n \"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"ComContainer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"DCRatBuild.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%TEMP%\\DCRatBuild.exe]- [targetUID: 00000000-00005748]\n \"ComContainer.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\"- Location: [%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe]- [targetUID: 00000000-00002448]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ComContainer.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\ComContainer.exe.log]- [targetUID: 00000000-00002448]\n Dropped file: \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe.log]- [targetUID: 00000000-00003384]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"conhost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"C:\\tempdir\\node_modules\\fined\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"%WINDIR%\\Tasks\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"%PROGRAMFILES%\\WindowsPowerShell\\Configuration\\Registration\\backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"DCRatBuild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"DCRatBuild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"ComContainer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc\" has section name .text with entropy \"7.998356911025703\"\n \"conhost.exe\" has section name .text with entropy \"7.446921759003501\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to retrieve open application windows","description":"Observed API \"GetForegroundWindow\" in \"conhost.exe\"\n Observed API \"GetWindowText\" in \"conhost.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-222","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$4a","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" wrote 16055 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DCRatBuild.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"$4b","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"sfxcmd=\"C:\\Users\\DcSD2JR\\AppData\\Local\\Temp\\DCRatBuild.exe\"\" (Indicator: \"cmd=\"; Source: \"00000000-00008028.00000000.138696.02820000.00000004.mdmp, 00000000-00008028.00000000.138696.02BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"DCRatBuild.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3801074b\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"DCRatBuild.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1d01080c\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"DCRatBuild.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"40107bf\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"DCRatBuild.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"ComContainer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access/write temporary files","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\bridgehyperblockreviewdhcp\\\\FCDPQha3l1059hFdl7xiPA.bat\" \"\" (UID: 00000000-00007744)","origin":"Monitored Target","mitre_attack_id":"T1074.001","relevance":5,"id":"target-423","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"DCRatBuild.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\__tmp_rar_sfx_access_check_908495109\" for deletion\n \"ComContainer.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Zs2XG1kf97\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"DCRatBuild.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\__tmp_rar_sfx_access_check_908495109\" with delete access\n \"ComContainer.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Zs2XG1kf97\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"DCRatBuild.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"ComContainer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\DCRatBuild.exe\"\" - (UID: 00000000-00003384)\n \"DCRatBuild.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"%TEMP%\\bridgehyperblockreviewdhcp\\JFcWz5uGBCcQNylIeBn.vbe\"\" - (UID: 00000000-00005748)\n \"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat\"\" - (UID: 00000000-00008028)\n \"ComContainer.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe\"\" - (UID: 00000000-00002448)\n \"ComContainer.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\cmd.exe\" /C \"%TEMP%\\mU8k0eGfsI.bat\"\" - (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\" was dropped at \"%WINDIR%\\Setup\\State\\fontdrvhost.exe\"\n File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 4 sections\" was dropped at \"%WINDIR%\\Tasks\\RuntimeBroker.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DCRatBuild.exe\" (Handle: 1304)\n \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DCRatBuild.exe\" (Handle: 1304)\n \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\DCRatBuild.exe\" (Handle: 1304)\n \"DCRatBuild.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 1400)\n \"ComContainer.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\ComContainer.exe\" (Handle: 2040)\n \"ComContainer.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\bridgehyperblockreviewdhcp\\ComContainer.exe\" (Handle: 2040)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"ComContainer.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00002448)\n \"ComContainer.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007068)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"ComContainer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"System Security","name":"Tries to disable secure desktop for UAC prompts","description":"\"ComContainer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"PROMPTONSECUREDESKTOP\")","origin":"Registry Access","mitre_attack_id":"T1548.002","relevance":5,"id":"registry-222","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"System Security","name":"Tries to disable user account control","description":"\"ComContainer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"CONSENTPROMPTBEHAVIORADMIN\")","origin":"Registry Access","mitre_attack_id":"T1548.002","relevance":5,"id":"registry-117","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe\" (UID: 00000000-00003384)\n Spawned process \"DCRatBuild.exe\" (UID: 00000000-00005748)\n Spawned process \"WScript.exe\" with commandline \"\"%TEMP%\\\\bridgehyperblockreviewdhcp\\\\JFcWz5uGBCcQNylIeBn.vbe\"\" (UID: 00000000-00008028)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%TEMP%\\\\bridgehyperblockreviewdhcp\\\\FCDPQha3l1059hFdl7xiPA.bat\" \"\" (UID: 00000000-00007744)\n Spawned process \"ComContainer.exe\" (UID: 00000000-00002448)\n Spawned process \"ComContainer.exe\" (UID: 00000000-00007068)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads the registry for VMWare specific artifacts"},{"detail":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":67,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"68a5603165da55600f0e3e94","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc","analysis_start_time":"2025-08-20T05:42:10+00:00","indicators_count":{"informative":188,"suspicious":53,"malicious":13},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}],"processes":[{"pid":3384,"ppid":0,"name":"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe","command_line":"","sha256":"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc","normalized_path":"C:\\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe","uid":"00000000-00003384","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5748,"ppid":3384,"name":"DCRatBuild.exe","command_line":"","sha256":"0b3af1714c58b112a179b1efe5d9b381cba0c06450860ae8134b386fe2fe5e8f","normalized_path":"%TEMP%\\DCRatBuild.exe","parent_uid":"00000000-00003384","uid":"00000000-00005748"},{"pid":8028,"ppid":5748,"name":"WScript.exe","command_line":"\"%TEMP%\\bridgehyperblockreviewdhcp\\JFcWz5uGBCcQNylIeBn.vbe\"","sha256":"d57c8674dacc2dd3c03c70ccb823a38bd89f7cabb1663e115e0cb720a0c12c34","normalized_path":"%WINDIR%\\SysWOW64\\WScript.exe","parent_uid":"00000000-00005748","uid":"00000000-00008028"},{"pid":7744,"ppid":8028,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008028","uid":"00000000-00007744"},{"pid":2448,"ppid":7744,"name":"ComContainer.exe","command_line":"","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","normalized_path":"%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe","parent_uid":"00000000-00007744","uid":"00000000-00002448"},{"pid":7068,"ppid":2448,"name":"ComContainer.exe","command_line":"","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","normalized_path":"%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe","parent_uid":"00000000-00002448","uid":"00000000-00007068"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","mscoreei.dll","shell32.dll","edputil.dll","usp10.dll","mscorlib.ni.dll","System.Web.dll","clr.dll","vcruntime140_clr0400.dll","powrprof.dll","slc.dll","System.Drawing.ni.dll","gdi32full.dll","psapi.dll","vbscript.dll","gpapi.dll","ole32.dll","sspicli.dll","wldp.dll","System.Management.ni.dll","ntmarta.dll","amsi.dll","OneCoreUAPCommonProxyStub.dll","System.Windows.Forms.ni.dll","clrjit.dll","wow64cpu.dll","VxSSL64.dll","user32.dll","ucrtbase_clr0400.dll","sxs.dll","msasn1.dll","cmdext.dll","wbemprox.dll","SHCore.dll","wintrust.dll","WMINet_Utils.dll","gdi32.dll","sechost.dll","shlwapi.dll","cldapi.dll","TextInputFramework.dll","CoreUIComponents.dll","devobj.dll","wpdshext.dll","version.dll","rsaenh.dll","windows.storage.dll","System.Runtime.Serialization.ni.dll","msvcp_win.dll","clbcatq.dll","userenv.dll","win32u.dll","advapi32.dll","riched20.dll","tiptsf.dll","scrobj.dll","wbemsvc.dll","apphelp.dll","ws2_32.dll","Microsoft.VisualBasic.ni.dll","urlmon.dll","System.Xml.ni.dll","cryptbase.dll","MMDevAPI.dll","comctl32.dll","PlayToDevice.dll","System.Configuration.ni.dll","mscoree.dll","crypt32.dll","scrrun.dll","ucrtbase.dll","CoreMessaging.dll","ntdll.dll","combase.dll","System.ni.dll","Windows.StateRepositoryPS.dll","mpr.dll","rpcrt4.dll","bcryptprimitives.dll","MpOAV.dll","msisip.dll","sppc.dll","msvcrt.dll","imagehlp.dll","wshext.dll","oleaut32.dll","bcrypt.dll","wow64.dll","wow64win.dll","WinTypes.dll","cfgmgr32.dll","coml2.dll","DevDispItemProvider.dll","cryptsp.dll","dJkIpmkh.dll","wmiutils.dll","imm32.dll","uxtheme.dll","System.Core.ni.dll","aepic.dll","sfc_os.dll","dlnashext.dll","fastprox.dll","profapi.dll","GdiPlus.dll","msls31.dll","MpClient.dll","fltLib.dll","kernel.appcore.dll","msIso.dll","WindowsCodecs.dll","propsys.dll","iertutil.dll","VxSSL32.dll","dwmapi.dll","pcacli.dll","msctf.dll","wbemcomn.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"taskhostw.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"conhost.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"ctfmon.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"smss.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"services.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"backgroundTaskHost.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"ComContainer.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"FCDPQha3l1059hFdl7xiPA.bat","sha256":"bae7494aa08a5d634830c205febb819b546b1633d2d2c74be6b78eee19c5514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"JFcWz5uGBCcQNylIeBn.vbe","sha256":"146e2cc8c7a342377dde4a2d323fba53afa9833e66539de23d120f414c4ffd4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"fontdrvhost.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"RuntimeBroker.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"csrss.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"OSPPSVC.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"TrustedInstaller.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"lsass.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Memory Compression.exe","sha256":"fb41a0fd339ab301f2f33eb97a562af1876e394493fe9f114fa6ff5f9f7d82b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe.log","sha256":"cdc2fe5839395e09c6f0195a23df86c991b6f407dc7a13b8ddcacabdfcd8214d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"ComContainer.exe.log","sha256":"2c94eff685650b75014fbe626050fb75d312ea708917a01e9e072c03df2090c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"27d1bcfc3c54e0","sha256":"6486b481e765c8d2241b29f286263a7787b9b6d4370df5ac154de0761bbd07ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"ea9f0e6c9e2dcd","sha256":"b8b26d795507fd4be3a6d876c89b8c65b7155a3bd6977b9e36b5d159a3eeeb51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"088424020bedd6","sha256":"dcc9c93242243aa9accdf5c7553765be1bc2a4f17e6292b5c00cfc8da4996f48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"26c12092da979c","sha256":"9ff0e2422042a22781a19c2c77961a12e0b409a7f050a1d7faec9309d722153c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"69ddcba757bf72","sha256":"28a8e99db71d57341abce10831e6a1e02edd56cf457d89c415438eab2529e1f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"c5b4cb5e9653cc","sha256":"69dd7333b028e7d01df8fa004b5b2b72484afedba5c30963e8b5533595070904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"eddb19405b7ce1","sha256":"f1dd9a52666c9cc3fd83245123e8b43e975d6e738ae2367ad13dc883c9a4087c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"DCRatBuild.exe","sha256":"0b3af1714c58b112a179b1efe5d9b381cba0c06450860ae8134b386fe2fe5e8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Zs2XG1kf97","sha256":"c45e8cf48adf69429c9c70649a3b88d66968ca6d9689e44f621eeb25bf42a4db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"mU8k0eGfsI.bat","sha256":"79d306518737d5fd3210ca73e5cd809ec5c3f92b362cd2ca01d5b6dc44f04052","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\DCRatBuild.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc.exe.log","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\bridgehyperblockreviewdhcp\\__tmp_rar_sfx_access_check_908495109","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\bridgehyperblockreviewdhcp\\FCDPQha3l1059hFdl7xiPA.bat","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\bridgehyperblockreviewdhcp\\ComContainer.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\bridgehyperblockreviewdhcp\\JFcWz5uGBCcQNylIeBn.vbe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\services.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\c5b4cb5e9653cc","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\TorService\\data\\fontdrvhost.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\TorService\\data\\5b884080fd4f94","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\TrustedInstaller.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\04c1e7795967e4","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\tempdir\\node_modules\\fined\\RuntimeBroker.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\tempdir\\node_modules\\fined\\9e8d7a4ca61bd9","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%WINDIR%\\Tasks\\RuntimeBroker.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%WINDIR%\\Tasks\\9e8d7a4ca61bd9","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\RuntimeBroker.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\9e8d7a4ca61bd9","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\fd7334d078e05ec916c8ee9df749ecc31ec2ddc44.5.32e6adcc3843db4019caa6e20d92ba1ac52139104a","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\ComContainer.exe.log","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\WindowsPowerShell\\Configuration\\Registration\\backgroundTaskHost.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\WindowsPowerShell\\Configuration\\Registration\\eddb19405b7ce1","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_161\\bin\\dtplugin\\System.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_161\\bin\\dtplugin\\27d1bcfc3c54e0","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\found.000\\dir0009.chk\\smss.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\found.000\\dir0009.chk\\69ddcba757bf72","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.171.37\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\EdgeUpdate\\1.3.171.37\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\TorService\\tor\\pluggable_transports\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\TorService\\tor\\pluggable_transports\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\inetpub\\history\\CFGHISTORY_0000000001\\System.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\inetpub\\history\\CFGHISTORY_0000000001\\27d1bcfc3c54e0","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\inetpub\\custerr\\Memory Compression.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\inetpub\\custerr\\1a5d5b8dcee3d8","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\tempdir\\node_modules\\pm2-sysmonit\\src\\Memory Compression.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\tempdir\\node_modules\\pm2-sysmonit\\src\\1a5d5b8dcee3d8","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\Uninstall Information\\smss.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\Uninstall Information\\69ddcba757bf72","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\taskhostw.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\ea9f0e6c9e2dcd","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\TorService\\data\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\TorService\\data\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%WINDIR%\\Setup\\State\\fontdrvhost.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%WINDIR%\\Setup\\State\\5b884080fd4f94","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\6203df4a6bafc7","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%WINDIR%\\Logs\\dosvc\\dwm.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\windows nt\\accessories\\ctfmon.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%PROGRAMFILES%\\(x86)\\windows nt\\accessories\\26c12092da979c","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\services.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\c5b4cb5e9653cc","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\OSPPSVC.exe","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"C:\\Recovery\\1610b97d3ab4a7","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\Zs2XG1kf97","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"path":"%TEMP%\\mU8k0eGfsI.bat","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ACTION CENTER\\CHECKS\\","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\tlZfsW8tRc4SayLvO","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3384:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3384:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:3384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:3384:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:3384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"tlZfsW8tRc4SayLvO","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:3384:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5748:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5748:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5748:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:5748:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:5748:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:5748:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:5748:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5748:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:8028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:8028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:8028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:8028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2448:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"fd7334d078e05ec916c8ee9df749ecc31ec2ddc4","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:2448:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:2448:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2448:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\fd7334d078e05ec916c8ee9df749ecc31ec2ddc4","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:7068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"Local\\SM0:7068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"SM0:7068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"68a5603165da55600f0e3e94"}]}]}},"report_ids":{"sandbox_job_ids":["68a5603165da55600f0e3e94"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSIL.Packy.Generic Sample 13cc97185f7c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 13cc97185f7c…. Malware family: MSIL.Packy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL.Packy.Generic Sample 13cc97185f7c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 13cc97185f7c…. Malware family: MSIL.Packy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/13cc97185f7caa3a67fb2f2325ae2741db7f880eeab103799cd3a2747056ccbc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL.Packy.Generic Sample 13cc97185f7c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 13cc97185f7c…. Malware family: MSIL.Packy.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4d","11",{}]]