Steam Community :: 76561199724331900

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 1445f8dc16bf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1445f8dc16bf…. Malware family: Zusy.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd"],"about":{"@type":"SoftwareApplication","name":"a43486128347.exe","applicationCategory":["peexe","executable"],"identifier":"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T44a,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp")28:T1a07,Assembly shows XOR instruction xor eax ebp in Stream UID: 1776-110-00417BFF Assembly shows XOR instruction xor ecx ebp in Stream UID: 1776-110-00417BFF Assembly shows XOR instruction xor eax ebp in Stream UID: 1776-136-00419FAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 1776-136-00419FAA Assembly shows XOR instruction xor eax ebp in Stream UID: 1776-404-00418B75 Assembly shows XOR instruction xor ecx ebp in Stream UID: 1776-404-00418B75 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 1776-495-0041572C Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 1776-495-0041572C Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 1776-495-0041572C Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 1776-495-0041572C Assembly shows XOR instruction xor eax ebp in Stream UID: 1776-577-00406A76 Assembly shows XOR instruction xor eax ebp in Stream UID: 1776-598-0041C498 Assembly shows XOR instruction xor ecx ebp in Stream UID: 1776-598-0041C498 Assembly shows XOR instruction xor eax ebp in Stream UID: 1776-604-0040F9AB Assembly shows XOR instruction xor ecx ebp in Stream UID: 1776-604-0040F9AB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-45-00180F50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-69-0017DA73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-69-0017DA73 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005420-2366-206-0018572C Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005420-2366-206-0018572C Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005420-2366-206-0018572C Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005420-2366-206-0018572C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-307-00186848 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-307-00186848 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-322-00188D25 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-322-00188D25 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-381-0018C9E9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-381-0018C9E9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-399-00186562 Assembly shows XOR instruction xor edx 000003C4h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor cx 0330h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor ebx esi in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor ax dx in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor si 02EDh in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor cx dx in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor esi 000001B1h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor dx 01BEh in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor eax FFFFAB00h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor si 0336h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor edi 000002B6h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor si di in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor ebx 00000273h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor bx 03B2h in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor dx 009Ch in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor eax 000015EBh in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor eax 000001AFh in Stream UID: 00000000-00005420-2366-446-00172021 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-629-00176A76 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005420-2366-671-00177815 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005420-2366-671-00177815 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005420-2366-671-00177815 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005420-2366-671-00177815 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005420-2366-671-00177815 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-744-0017F9AD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-744-0017F9AD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-748-00188B75 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-748-00188B75 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-758-00189B73 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-758-00189B73 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-829-00187749 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-829-00187749 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-837-00187C01 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-837-00187C01 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-838-00187CDC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-838-00187CDC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-839-00187DC5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-839-00187DC5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005420-2366-851-001885EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005420-2366-851-001885EE29:T95f,Found XOR loop in file "sample.bin" at offset 218578; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 243628; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 254168; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 265422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 267937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 315351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 367231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 418299; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 457469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 520725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 533407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 549711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 27742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 30983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 254298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 262477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 265105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 314867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 319277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 398265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 448741; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 500829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 43159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 87525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 236439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 544982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 549692; code bytes = 80302a:T6f4,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp")2b:Tcfc,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006300909b63008b9b6300000000000000000000005f0000000001b4de40000000000018ec400095e1ca77fcb60900feffffff435cce775059ce77aa000000b80000008a9b6300889b63003ce0400074e4400000000000000000000000000000000000000000000000000000000000000000001c5ccd7760d8da75ffffffff17000000ecdf40002400000003000000dce4400008ea400074e440008600000018e0400096edce77b29b6300a06aa475860000003ce0400074e440000000000086008800a06aa4753ce04000916ca475b29b6300a06aa475a06aa475ace4400002020000 (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005420) "MSBuild.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005484) "MSBuild.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005484)2c:T4c2,"MSBuild.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005484) "MSBuild.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005484)2d:T1ca8,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005420) "MSBuild.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005484) "MSBuild.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00005484)2e:T6c02,Found reference to API (Indicator: "GetCommandLineW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetModuleFileNameW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "TlsSetValue"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetFileSizeEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "WriteConsoleW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "LeaveCriticalSection"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "ReadFile"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "TerminateProcess"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "MultiByteToWideChar"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "SetStdHandle"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "EnterCriticalSection"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "WriteFile"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetModuleHandleW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "ExitProcess"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "TlsAlloc"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "EncodePointer"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetCurrentThreadId"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "LCMapStringEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "RtlUnwind"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetACP"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "HeapFree"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "ReadConsoleW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "HeapReAlloc"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "DecodePointer"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "AttachConsole"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "DeleteCriticalSection"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "IsDebuggerPresent"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetFileType"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetStartupInfoW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "IsValidCodePage"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "SetFilePointerEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FindNextFileW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetCPInfo"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FindFirstFileExW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "WideCharToMultiByte"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetLocaleInfoW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetModuleHandleExW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetProcessHeap"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetStdHandle"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "IsValidLocale"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "TlsFree"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetCurrentProcess"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "HeapSize"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetLastError"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "InitializeSListHead"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "HeapAlloc"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetProcAddress"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetCurrentProcessId"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "RaiseException"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetOEMCP"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "SetLastError"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetStringTypeW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "TlsGetValue"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FreeLibrary"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FlushFileBuffers"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetCommandLineA"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetConsoleMode"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "LoadLibraryExW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FindClose"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "LCMapStringW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "CloseHandle"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "CreateFileW"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FlsAlloc"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FlsFree"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FlsGetValue"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "FlsSetValue"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "AreFileApisANSI"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "CompareStringEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetDateFormatEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetTimeFormatEx"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "IsValidLocaleName"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "LCIDToLocaleName"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "LocaleNameToLCID"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API (Indicator: "CreateProcessA"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; File: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005420.00000000.72348.001F5000.00000040.mdmp")2f:T739,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75a40000 "MSBuild.exe" loaded module "DNSAPI.DLL" at base 75420000 "MSBuild.exe" loaded module "RPCRT4.DLL" at base 762f0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 750c0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75550000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75560000 "MSBuild.exe" loaded module "IPHLPAPI.DLL" at base 73f00000 "MSBuild.exe" loaded module "RASADHLP.DLL" at base 71ff0000 "MSBuild.exe" loaded module "WINHTTP.DLL" at base 72070000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73e70000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 753a0000 "MSBuild.exe" loaded module "ADVAPI32.DLL" at base 76960000 "MSBuild.exe" loaded module "SECUR32.DLL" at base 758c0000 "MSBuild.exe" loaded module "NCRYPT.DLL" at base 756d0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75270000 "MSBuild.exe" loaded module "USER32.DLL" at base 76f70000 "MSBuild.exe" loaded module "CRYPT32.DLL" at base 75bc0000 "MSBuild.exe" loaded module "USERENV.DLL" at base 75eb0000 "MSBuild.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77e30000 "MSBuild.exe" loaded module "GPAPI.DLL" at base 75170000 "MSBuild.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77e30000 "MSBuild.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77e30000 "MSBuild.exe" loaded module "CRYPTSP.DLL" at base 755a0000 "MSBuild.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75330000 "MSBuild.exe" loaded module "CRYPTBASE.DLL" at base 75a90000 "MSBuild.exe" loaded module "WS2_32.DLL" at base 7645000030:Tb51,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")31:Te14,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "1445F8DC16BF7F0E1C7B3D16BEE14EF83E6170AB00A2381D509051C64617FBFD"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLELOCALOVERRIDE"; Value: "")32:Td53,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\FLTLIB.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\MSVCP140.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\VCRUNTIME140.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\ucrtbase.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll"33:Tdbd,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\MSVCP140.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\ucrtbase.DLL" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll"34:T653,"MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "303048" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "30f200" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "31bae0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "30dc70" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2ff900" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "MSBuild.exe" called "WinHttpSendRequest" with parameters {"hRequest": "30dc70" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}35:T6dc8,"GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com" "HTTP/1.1 200 OKServer: nginxContent-Type: text/html; charset=UTF-8X-Frame-Options: SAMEORIGINContent-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;Expires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Wed, 12 Aug 2026 05:02:48 GMTContent-Length: 30481Connection: keep-aliveSet-Cookie: sessionid=ed2838ff144d168aa89716f5; Path=/; Secure; SameSite=NoneSet-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=NoneSteam Community :: 76561199724331900

76561199724331900

responsive_page_legacy_content -->

responsive_page_content -->

responsive_page_frame -->"36:Tef0,"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\*.* (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter 1033 (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter Accessibility.dll (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AddInProcess.exe (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AddInProcess.exe.config (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AddInProcess32.exe (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AddInProcess32.exe.config (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AddInUtil.exe (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AddInUtil.exe.config (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AdoNetDiag.dll (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter adonetdiag.mof (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter adonetdiag.mof.uninstall (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter alink.dll (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AppLaunch.exe (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter applaunch.exe.config (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter ASP.NETWebAdminFiles (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter Aspnet.config (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter aspnet.mof (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter aspnet.mof.uninstall (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter AspNetMMCExt.dll (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter aspnet_compiler.exe (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter aspnet_filter.dll (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter aspnet_isapi.dll (UID: 00000000-00005420) "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe" called "FindNextFileW" with parameter Aspnet_perf.dll (UID: 00000000-00005420)37:T608,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005420.00000000.72348.00193000.00000002.mdmp")38:Ta8e,Found string "FlsAlloc" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: UCRTBASE.DLL) Found string "AreFileApisANSI" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNEL32.DLL) Found string "GetLocaleInfoEx" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNEL32.DLL) Found string "GetUserDefaultLocaleName" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "LCIDToLocaleName" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd, API is part of module: KERNELBASE.DLL)39:T9eb,"MSBuild.exe" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "MSBuild.exe" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "MSBuild.exe" monitors "HKLM\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "MSBuild.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "MSBuild.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 5; Subtree: 1)3a:T5df,Wrote 200 instructions to a remote process Wrote 4 instructions to a remote process Wrote 7 instructions to a remote process Wrote 8 instructions to a remote process Wrote 3 instructions to a remote process Wrote 32 instructions to a remote process Wrote 28 instructions to a remote process Wrote 19 instructions to a remote process Wrote 27 instructions to a remote process Wrote 33 instructions to a remote process Wrote 416 instructions to a remote process Wrote 189 instructions to a remote process Wrote 1803 instructions to a remote process Wrote 45 instructions to a remote process Wrote 39 instructions to a remote process Wrote 17 instructions to a remote process Wrote 102 instructions to a remote process Wrote 90 instructions to a remote process Wrote 46 instructions to a remote process Wrote 76 instructions to a remote process Wrote 51 instructions to a remote process Wrote 23 instructions to a remote process Wrote 31 instructions to a remote process Wrote 30 instructions to a remote process Wrote 34 instructions to a remote process Wrote 36 instructions to a remote process Wrote 20 instructions to a remote process Wrote 77 instructions to a remote process Wrote 22 instructions to a remote process Wrote 52 instructions to a remote process Wrote 41 instructions to a remote process Wrote 6 instructions to a remote process Wrote 5 instructions to a remote process Wrote 13 instructions to a remote process Wrote 29 instructions to a remote process3b:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791020120341,"unified_at":"2026-10-03T09:35:20.341Z","metadata":{"hashes":{"sha256":"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd","sha1":"906055b36647c5bae02e9e2db41bef9a17e2f3b1","md5":"c70170bcedd92e90f2556c7501b1a559","sha512":"eed90b78a01fa2be870ea2d2f02cdc55fd6e53e63fc96dbf9e604af56846ff604dddf44894df1317fa4f3364a1ee3f4cd535892681f52ac3494c3835206246a4","ssdeep":"12288:PMyHj9OPDUY0MYICPYpRx2LHdzW8J9DpddINVzb3FXPa1c5A4S:PB9O5CQpM9zW8/DfyNV33N5x","ssdeep_chunks":["12288:PMyHj9O","12288:MyHj9OP","12288:yHj9OPD","12288:Hj9OPDU","12288:j9OPDUY","12288:9OPDUY0","12288:OPDUY0M","12288:PDUY0MY","12288:DUY0MYI","12288:UY0MYIC","12288:Y0MYICP","12288:0MYICPY","12288:MYICPYp","12288:YICPYpR","12288:ICPYpRx","12288:CPYpRx2","12288:PYpRx2L","12288:YpRx2LH","12288:pRx2LHd","12288:Rx2LHdz","12288:x2LHdzW","12288:2LHdzW8","12288:LHdzW8J","12288:HdzW8J9","12288:dzW8J9D","12288:zW8J9Dp","12288:W8J9Dpd","12288:8J9Dpdd","12288:J9DpddI","12288:9DpddIN","12288:DpddINV","12288:pddINVz","12288:ddINVzb","12288:dINVzb3","12288:INVzb3F","12288:NVzb3FX","12288:Vzb3FXP","12288:zb3FXPa","12288:b3FXPa1","12288:3FXPa1c","12288:FXPa1c5","12288:XPa1c5A","12288:Pa1c5A4","12288:a1c5A4S","24576:PMyHj9O","24576:MyHj9OP","24576:yHj9OPD","24576:Hj9OPDU","24576:j9OPDUY","24576:9OPDUY0","24576:OPDUY0M","24576:PDUY0MY","24576:DUY0MYI","24576:UY0MYIC","24576:Y0MYICP","24576:0MYICPY","24576:MYICPYp","24576:YICPYpR","24576:ICPYpRx","24576:CPYpRx2","24576:PYpRx2L","24576:YpRx2LH","24576:pRx2LHd","24576:Rx2LHdz","24576:x2LHdzW","24576:2LHdzW8","24576:LHdzW8J","24576:HdzW8J9","24576:dzW8J9D","24576:zW8J9Dp","24576:W8J9Dpd","24576:8J9Dpdd","24576:J9DpddI","24576:9DpddIN","24576:DpddINV","24576:pddINVz","24576:ddINVzb","24576:dINVzb3","24576:INVzb3F","24576:NVzb3FX","24576:Vzb3FXP","24576:zb3FXPa","24576:b3FXPa1","24576:3FXPa1c","24576:FXPa1c5","24576:XPa1c5A","24576:Pa1c5A4","24576:a1c5A4S","12288:PB9O5CQ","12288:B9O5CQp","12288:9O5CQpM","12288:O5CQpM9","12288:5CQpM9z","12288:CQpM9zW","12288:QpM9zW8","12288:pM9zW8/","12288:M9zW8/D","12288:9zW8/Df","12288:zW8/Dfy","12288:W8/DfyN","12288:8/DfyNV","12288:/DfyNV3","12288:DfyNV33","12288:fyNV33N","12288:yNV33N5","12288:NV33N5x"],"imphash":"d10af643340e1121562abe3e6bd5b0e1"},"file_info":{"file_name":"a43486128347.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":551424,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1728325040000,"last_seen":1786510917000,"last_multi_scan":1786510917000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio","commodity","mikey","credentialharvesting","lummastealer","criminal","informationstealer"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":53},"sandbox_signatures":{"informative_count":116,"suspicious_count":12,"malicious_count":6,"total":134},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Vidar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.StealerC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.562995","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.562995 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HYAB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"VHO:TrojanPSW.Stealerc.gen.pxnl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.bxu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 00584baa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AKI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.MVZ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.EAOY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4903662","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Zusy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"MSBuild","attack_id":"T1127.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1127/001","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Makes HTTPS connections using an insecure TLS/SSL version"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTPS web server (GET/POST requests)"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"decompression failed or archive is corrupted\" (Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found string \"compression failed\" (Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found string \"system.io.compression.dll\" (Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 1776-552-00407AAF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005420-2366-69-0017DA73\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005420-2366-71-00177610\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005420-2366-646-00177922\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005420-2366-1295-00177AAF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005484-00000C2C-163129684\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00005484-00000C2C-163279511\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00005484-00000C2C-163280148\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.72322","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Decrypted SSL network traffic\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005484-00000C2C-163257796\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005484-00000C2C-163257931\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005484-00000C2C-136886481\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"MSBuild.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005484)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005420)\n \"MSBuild.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005484)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" called \"IsWow64Process\" with parameter \"5420\" - (UID: 00000000-00005420)\n \"MSBuild.exe\" called \"IsWow64Process\" with parameter \"5484\" - (UID: 00000000-00005484)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"MSBuild.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005484)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00005420-2366-758-00189B73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005420-2366-671-00177815","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005420-2366-671-00177815","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 1776-592-0041C91A\n GetLocaleInfoW@KERNEL32.dll at 1776-598-0041C498\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005420-2366-333-0018626A\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005420-2366-338-00185D7F\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005420-2366-348-0018622B\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005420-2366-381-0018C9E9\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005420-2366-382-0018C327\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005420-2366-383-0018C40D\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005420-2366-385-0018C814\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00005420-2366-386-0018C372\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005420-2366-883-0018C282\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005420-2366-886-0018C49A\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005420-2366-887-0018C91A\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005420-2366-888-0018C6ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00005420-2366-1264-0018CC4B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower\" (SID: 2071343, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 105042)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00005420)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"184.85.65.125:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"216776,5416,3142,,CreateProcessA,kernel32.dll,\"252:04:18.392\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005420-2366-720-0017B3A2\n LoadLibraryA@KERNEL32.DLL at 00000000-00005420-2366-1300-001F5C1D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"MSBuild.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 756B0000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75270000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 762F0000\n \"MSBuild.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 762F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f45176@RPCRT4.dll\"\n \"1800190068e8836b@api-ms-win-core-synch-l1-2-0.DLL\"\n \"1800190088e8836b@api-ms-win-core-synch-l1-2-0.DLL\"\n \"0d000e00cc5f836b@ntdll.dll\"\n \"150016002073b16b@ADVAPI32.dll\"\n \"0e000f00e473b16b@ADVAPI32.dll\"\n \"0e000f005074b16b@ADVAPI32.dll\"\n \"11001200d47db16b@ADVAPI32.dll\"\n \"110012007c7eb16b@ADVAPI32.dll\"\n \"12001300cc7eb16b@ADVAPI32.dll\"\n \"12001300387fb16b@ADVAPI32.dll\"\n \"14001500e4b7b16b@ADVAPI32.dll\"\n \"1400150000b8b16b@ADVAPI32.dll\"\n \"140015001cb8b16b@ADVAPI32.dll\"\n \"1700180038b8b16b@ADVAPI32.dll\"\n \"0d000e0054b8b16b@ADVAPI32.dll\"\n \"1100120064b8b16b@ADVAPI32.dll\"\n \"110012007cb8b16b@ADVAPI32.dll\"\n \"0d000e009c7fb16b@SHELL32.dll\"\n \"0d000e002880b16b@SHELL32.dll\"\n \"10001100acb9b16b@crypt32.dll\"\n \"12001300d4b9b16b@crypt32.dll\"\n \"0f001000ecb9b16b@ADVAPI32.dll\"\n \"1400150000bab16b@crypt32.dll\"\n \"140015001cbab16b@crypt32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" file has an entrypoint instructions - \"call\t0x407862,jmp\t0x406dd6,push\tebp,mov\tebp, esp,mov\teax, dword ptr [ebp + 8],push\tesi,mov\tecx, dword ptr [eax + 0x3c],add\tecx, eax,movzx\teax, word ptr [ecx + 0x14],lea\tedx, [ecx + 0x18],add\tedx, eax,movzx\teax, word ptr [ecx + 6],imul\tesi, eax, 0x28,add\tesi, edx,cmp\tedx, esi,je\t0x406f97,mov\tecx, dword ptr [ebp + 0xc],cmp\tecx, dword ptr [edx + 0xc],jb\t0x406f90,mov\teax, dword ptr [edx + 8],add\teax, dword ptr [edx + 0xc],cmp\tecx, eax,jb\t0x406f9c,add\tedx, 0x28,cmp\tedx, esi,jne\t0x406f81,xor\teax, eax,pop\tesi,pop\tebp,ret\t,mov\teax, edx,jmp\t0x406f99,push\tesi,call\t0x407bc5,test\teax, eax,je\t0x406fca,mov\teax, dword ptr fs:[0x18],mov\tesi, 0x486754,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"MSBuild.exe\" (UID: 00000000-00005484) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"MSBuild.exe\" (UID: 00000000-00005484) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"bemuzzeki.sbs\"\n \"exemplarou.sbs\"\n \"exilepolsiy.sbs\"\n \"frizzettei.sbs\"\n \"invinjurhey.sbs\"\n \"isoplethui.sbs\"\n \"laddyirekyi.sbs\"\n \"steamcommunity.com\"\n \"wickedneatr.sbs\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00005484-00000C2B-163059078]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"MSBuild.exe\" (UID: 00000000-00005484)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"MSBuild.exe\" (UID: 00000000-00005484)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 305817)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert EV RSA CA G2, O=DigiCert Inc, C=US\" (SHA1: 41:3C:40:63:B9:78:68:32:EB:FA:54:6A:05:DA:00:4C:70:48:C6:F6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 09:0A:16:F9:BA:16:00:1B:2E:C1:30:F8:05:23:E5:B5:EB:25:91:58; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$34","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"MSBuild.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"30dc70\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"Found requests in header \"GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005484-00000C2C-162968242\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005484-00000C2C-162968552\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$35","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"steamcommunity.com\"\n Heuristic match: \"get /profiles/76561199724331900 http/1.1connection: keep-aliveuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/119.0.0.0 safari/537.36host: steamcommunity.com\"\n Pattern match: \"https://community.akamai.steamstatic.com/\"\n Pattern match: \"https://steamcommunity.com/discussions/\"\n Pattern match: \"https://community.akamai\"\n Heuristic match: \"se;.wsf;.ws\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"exemplarou.sbs\" has high entropy\n Contacted domain: \"invinjurhey.sbs\" has high entropy\n Contacted domain: \"wickedneatr.sbs\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"184.85.65.125\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"file/memory contains long string with (Indicator: \"gcloud\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MSBuild.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"system.io.compression.zipfile.dll\" (Indicator: \"zipfile\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.security.cryptography.csp.dll\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.security.cryptography.algorithms.dll\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.security.cryptography.encoding.dll\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.security.cryptography.primitives.dll\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")\n Found string \"system.security.cryptography.x509certificates.dll\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"L[f9]\" (Indicator: \"[F9]\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found string \"L[f9]\" (Indicator: \"[F9]\"; Source: \"00000000-00005420.00000000.72348.00171000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005420.00000000.72348.005F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.001F5000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp, 00000000-00005420.00000000.72348.0019D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005420.00000000.72348.00193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"MSBuild.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd\" has section name .data with entropy \"7.992609431877337\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe queries ProcessDebugPort (UID: 5420)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00005420-2366-644-0017729C\n cpuid at 00000000-00005484-6035-262-0043EB00\n cpuid at 00000000-00005484-6035-351-00433F20\n cpuid at 00000000-00005484-6035-355-00433DE0\n cpuid at 00000000-00005484-6035-1937-004341FB\n cpuid at 00000000-00005484-6035-1938-00434218\n cpuid at 00000000-00005484-6035-1940-0043426F\n cpuid at 00000000-00005484-6035-2266-00434191","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00005420-2366-45-00180F50\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005420-2366-68-00180EEB\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005420-2366-946-00177A6D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00005420-2366-672-00177A37\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005420-2366-802-0018519E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/27 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$39","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 184.85.65.125 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 1776-546-0041A5AE\n GetCommandLineA@KERNEL32.DLL at 00000000-00005420-2366-1285-0018A5AE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00005420-2366-756-001806EB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00005420-2366-44-00180EBA\n TerminateProcess@KERNEL32.DLL at 00000000-00005420-2366-71-00177610\n TerminateProcess@KERNEL32.DLL at 00000000-00005420-2366-84-0017DC9C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetCommandLineW\n GetModuleFileNameW\n GetFileSizeEx\n TerminateProcess\n WriteFile\n GetModuleHandleW\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetStartupInfoW\n FindNextFileW\n FindFirstFileExW\n GetModuleHandleExW\n GetProcAddress\n GetCommandLineA\n LoadLibraryExW\n CreateFileW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" - (UID: 00000000-00005420)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/27 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"level":"malicious","category":"Network Related","name":"Makes HTTPS connections using an insecure TLS/SSL version","description":"Connection was made using TLSv1.0 [tls.handshake.version: 0x0301]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 9 domains and 9 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":68,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":9,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["urlscanio","commodity","mikey","credentialharvesting","lummastealer","criminal","informationstealer"],"sample_flags":["Network Traffic","User Comment","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a7bfe4426f63babcc0e1389","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Kryptik.oa","contacted_countries":["USA"],"submit_name":"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd","analysis_start_time":"2026-08-12T05:01:57+00:00","indicators_count":{"informative":116,"suspicious":28,"malicious":6},"tags":["Network Traffic","User Comment","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"184.85.65.125","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]}],"dns_resolutions":[{"domain":"bemuzzeki.sbs","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"exemplarou.sbs","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"exilepolsiy.sbs","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"frizzettei.sbs","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"invinjurhey.sbs","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"isoplethui.sbs","ttl":898,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"laddyirekyi.sbs","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"steamcommunity.com","address":"184.85.65.125","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]},{"domain":"wickedneatr.sbs","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7bfe4426f63babcc0e1389"}],"processes":[{"pid":5420,"ppid":0,"name":"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe","command_line":"","sha256":"1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd","normalized_path":"C:\\1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd.exe","uid":"00000000-00005420","icon":"$3b"},{"pid":5484,"ppid":5420,"name":"MSBuild.exe","command_line":"","sha256":"d94e9ea7dce3dd4760f48356f14a986ea1fc8f1c84864105bf815a32284296ab","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00005420","uid":"00000000-00005484"}],"all_imported_dlls":["fltLib.dll","api-ms-win-crt-string-l1-1-0.dll","oleaut32.dll","winnsi.dll","api-ms-win-core-synch-l1-2-0.dll","rpcrt4.dll","nsi.dll","shlwapi.dll","api-ms-win-core-processthreads-l1-1-1.dll","imm32.dll","ncrypt.dll","msvcp140.dll","api-ms-win-core-file-l2-1-0.dll","WSHTCPIP.DLL","api-ms-win-crt-math-l1-1-0.dll","secur32.dll","gdi32.dll","lpk.dll","msvcrt.dll","api-ms-win-core-file-l1-2-0.dll","shell32.dll","winhttp.dll","mswsock.dll","rasadhlp.dll","wshqos.dll","profapi.dll","VxSSL32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","webio.dll","IPHLPAPI.DLL","gpapi.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","sechost.dll","bcrypt.dll","bcryptprimitives.dll","vcruntime140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","msctf.dll","apphelp.dll","crypt32.dll","usp10.dll","ws2_32.dll","user32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","ole32.dll","wship6.dll","api-ms-win-crt-runtime-l1-1-0.dll","ucrtbase.dll","api-ms-win-crt-locale-l1-1-0.dll","advapi32.dll","credssp.dll","dnsapi.dll","schannel.dll","userenv.dll","kernel32.dll","KernelBase.dll","api-ms-win-crt-stdio-l1-1-0.dll","msasn1.dll","cryptsp.dll","ntdll.dll","sspicli.dll","rsaenh.dll","FWPUCLNT.DLL","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6a7bfe4426f63babcc0e1389"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Zusy.Generic Sample 1445f8dc16bf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1445f8dc16bf…. Malware family: Zusy.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd"}],["$","meta","4",{"property":"og:title","content":"Malicious Zusy.Generic Sample 1445f8dc16bf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1445f8dc16bf…. Malware family: Zusy.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1445f8dc16bf7f0e1c7b3d16bee14ef83e6170ab00a2381d509051c64617fbfd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Zusy.Generic Sample 1445f8dc16bf… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1445f8dc16bf…. Malware family: Zusy.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]