24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.WannaCryptor Sample 149601e15002… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 149601e15002…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","keywords":["Malicious","Trojan.Ransom.WannaCryptor","malware analysis","sandbox report","threat intelligence","149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.WannaCryptor","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T487,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")26:T595,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "taskse.exe.539085069") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")27:T4e5,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp")28:T442,Found PE header "MZ" - Source: "00000000-00002828.00000000.78184.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000000.77862.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000000.77862.10000000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000001.79781.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000001.79781.10000000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000002.81701.00400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000002.81701.02E20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006324.00000002.81701.10000000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006960.00000000.78563.00D00000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006960.00000000.78563.737F0000.00000002.mdmp")29:T10fa,".exe" renamed original file"C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.WNCRYT" to "%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.WNCRY" ".exe" renamed original file"C:\$WINDOWS.~BT\Sources\hwcompat.txt.WNCRYT" to "C:\$WINDOWS.~BT\Sources\hwcompat.txt.WNCRY" ".exe" renamed original file"C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT" to "%USERPROFILE%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\male_names.txt.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\male_names.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\surnames.txt.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\surnames.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\us_tv_and_film.txt.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\us_tv_and_film.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT" to "%LOCALAPPDATA%\Microsoft\Internet Explorer\brndlog.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1d6692aa-cfb0-4b91-98e2-167755c4568a}\0.0.filtertrie.intermediate.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1d6692aa-cfb0-4b91-98e2-167755c4568a}\0.0.filtertrie.intermediate.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appsglobals.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appsglobals.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appssynonyms.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appssynonyms.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\settingsglobals.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\settingsglobals.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\settingssynonyms.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\settingssynonyms.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2914871c-12b8-49a8-87b7-27e43148a1ce}\0.0.filtertrie.intermediate.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2914871c-12b8-49a8-87b7-27e43148a1ce}\0.0.filtertrie.intermediate.txt.WNCRY" ".exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT" to "%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY"2a:T3df0,Assembly shows XOR instruction xor dword ptr [edx] ebx in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor ebx dword ptr [0040A7FCh+eax*4] in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor ebx dword ptr [00409FFCh+eax*4] in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor ebx dword ptr [00409BFCh+eax*4] in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor ebx dword ptr [eax] in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor al dl in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor al byte ptr [ebp+08h] in Stream UID: 00000000-00006324-58962-23-00403797 Assembly shows XOR instruction xor ecx ebx in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor dword ptr [esi+00000414h] ecx in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor dword ptr [eax] ebx in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor dword ptr [esi+00000424h] ecx in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor edx dword ptr [0040AFFCh+ebx*4] in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor edx dword ptr [0040B3FCh+ebx*4] in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor edx dword ptr [0040B7FCh+eax*4] in Stream UID: 00000000-00006324-58962-28-00402A76 Assembly shows XOR instruction xor byte ptr [eax] dl in Stream UID: 00000000-00006324-58962-25-00403A28 Assembly shows XOR instruction xor edx dword ptr [edi+08h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor esi dword ptr [edi+0Ch] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor ecx dword ptr [edi+10h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor ebx dword ptr [edi+14h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edi dword ptr [00408FFCh+ebx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edi dword ptr [00408BFCh+eax*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edi dword ptr [004097FCh+eax*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edi dword ptr [eax-04h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [00408BFCh+ebx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [004093FCh+ebx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [004097FCh+edx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [edx] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [004093FCh+edx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [00408FFCh+edx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor eax dword ptr [ebx-1Ch] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edx dword ptr [00408FFCh+ecx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edx dword ptr [00408BFCh+ecx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edx dword ptr [004097FCh+ecx*4] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor edx dword ptr [ebx-28h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor al bl in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor bl dl in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor dl bl in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor dl byte ptr [ebp-04h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor cl byte ptr [ebp-04h] in Stream UID: 00000000-00006324-58962-27-00402E7E Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006324-58962-59-004043B6 Assembly shows XOR instruction xor dword ptr [edx] ebx in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor ebx dword ptr [004097FCh+eax*4] in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor ebx dword ptr [00408FFCh+eax*4] in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor ebx dword ptr [00408BFCh+eax*4] in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor ebx dword ptr [eax] in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor al dl in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor al byte ptr [ebp+08h] in Stream UID: 00000000-00006324-58962-26-0040350F Assembly shows XOR instruction xor ecx dword ptr [edi+000001E8h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor esi dword ptr [edi+000001ECh] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor esi dword ptr [edi+000001F0h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edx dword ptr [edi+000001F4h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edi dword ptr [00409BFCh+ebx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edi dword ptr [00409FFCh+eax*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edi dword ptr [0040A7FCh+eax*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edi dword ptr [edx-04h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor eax dword ptr [00409FFCh+ebx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor eax dword ptr [0040A3FCh+ebx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor eax dword ptr [0040A7FCh+ebx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor eax dword ptr [edx] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edx dword ptr [00409FFCh+ebx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edx dword ptr [0040A3FCh+ebx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edx dword ptr [0040A7FCh+ecx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor edx dword ptr [ecx+04h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor ecx dword ptr [0040A3FCh+edx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor ecx dword ptr [00409BFCh+edx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor ecx dword ptr [0040A7FCh+edx*4] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor ecx dword ptr [edx-08h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor al bl in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor bl dl in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor dl bl in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor dl byte ptr [ebp-04h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor cl byte ptr [ebp-04h] in Stream UID: 00000000-00006324-58962-24-004031BC Assembly shows XOR instruction xor eax 00FFFFFFh in Stream UID: 00000000-00002828-413-272-00406F80 Assembly shows XOR instruction xor edx 00FFFFFFh in Stream UID: 00000000-00002828-413-272-00406F80 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00002828-413-220-00408D70 Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00002828-413-220-00408D70 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002828-413-220-00408D70 Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor eax edi in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor ecx dword ptr [004195B0h+edx*4] in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor ecx dword ptr [004199B0h+edx*4] in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00002828-413-192-0040A150 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor esi edi in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor ecx ebx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor esi ebx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor edi ebx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor dl al in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor dl bl in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00002828-413-191-0040A610 Assembly shows XOR instruction xor cl dl in Stream UID: 00000000-00002828-413-187-0040B3C0 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002828-413-205-00409C20 Assembly shows XOR instruction xor edx edi in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor esi ebp in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor ecx edi in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor ebx ebp in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor esi edi in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor esi ebx in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor edi eax in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor edi ebp in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor edi ebx in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor ebp eax in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor ebp ebx in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor ebp edx in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor bl cl in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor cl bl in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00002828-413-189-0040A9D0 Assembly shows XOR instruction xor dword ptr [edi] ecx in Stream UID: 00000000-00002828-413-188-0040B0C0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00002828-413-188-0040B0C0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002828-413-188-0040B0C0 Assembly shows XOR instruction xor al dl in Stream UID: 00000000-00002828-413-188-0040B0C0 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00002828-413-188-0040B0C0 Assembly shows XOR instruction xor dword ptr [edi] ecx in Stream UID: 00000000-00002828-413-190-0040ADC0 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00002828-413-190-0040ADC0 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002828-413-190-0040ADC0 Assembly shows XOR instruction xor al dl in Stream UID: 00000000-00002828-413-190-0040ADC0 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00002828-413-190-0040ADC0 Assembly shows XOR instruction xor dl cl in Stream UID: 00000000-00002828-413-145-0040D2B0 Assembly shows XOR instruction xor bl cl in Stream UID: 00000000-00002828-413-145-0040D2B0 Assembly shows XOR instruction xor byte ptr [ebp-537FFFF0h] 03h in Stream UID: 3884-662-00412E0C Assembly shows XOR instruction xor edx edi in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor esi ebp in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor ecx edi in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor ebx ebp in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor esi edi in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor esi ebx in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor edi eax in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor edi ebp in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor edi ebx in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor ebp eax in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor ebp ebx in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor ebp edx in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor edx ecx in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor edx ebx in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor bl cl in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor cl bl in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor dl cl in Stream UID: 3884-330-0040A9D0 Assembly shows XOR instruction xor edx dword ptr [ecx-7Bh] in Stream UID: 3884-840-00419F47 Assembly shows XOR instruction xor cl byte ptr [eax-13h] in Stream UID: 3884-840-00419F47 Assembly shows XOR instruction xor ah ch in Stream UID: 3884-840-00419F47 Assembly shows XOR instruction xor al 9Dh in Stream UID: 3884-840-00419F47 Assembly shows XOR instruction xor al 7Eh in Stream UID: 3884-840-00419F47 Assembly shows XOR instruction xor byte ptr [edi] 02h in Stream UID: 3884-489-00412C92 Assembly shows XOR instruction xor eax 00FFFFFFh in Stream UID: 3884-461-00406F80 Assembly shows XOR instruction xor edx 00FFFFFFh in Stream UID: 3884-461-00406F80 Assembly shows XOR instruction xor byte ptr [ebx] cl in Stream UID: 3884-435-00412DAC Assembly shows XOR instruction xor byte ptr [eax] 0Bh in Stream UID: 3884-349-00412DDC Assembly shows XOR instruction xor bl al in Stream UID: 3884-207-004101502b:T41a,Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CryptGenKey" (Indicator: "CryptGenKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin")2c:Ta79,".exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006324) ".exe" called "RtlGetVersion" (UID: 00000000-00006324) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006324) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006220) "@WanaDecryptor@.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "RtlGetVersion" (UID: 00000000-00002828)2d:T46b,"@WanaDecryptor@.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000780c9e02637a747778ea8f00591675770100000008000000010000000000c2020000000010000000000000000000000002000000020000000000c20201000000080000000000000098ea8f00ee13757701000000ee13757708000000000000000800000001000000d0ec8f00ad9c34720000c2020800000001000000 (UID: 00000000-00002828) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000085008000000000000000f853fe744cdd6f00ee13757780000000ee137577000000000000000080000000f06247727f381ffb6cdd6f0050723d74000085000000000080000000f062477202000000002f477288dd6f00fb6247720100000080044872885f3f7400000000a64dfb0bb8dd6f00b8644772f42e4772 (UID: 00000000-00006960) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000006908de030000003c3b437202000000c01a44720897850000978500596908ded0c56f003c3b4372bcc66f0010104472591122acfeffffff321244724c124472c01a447238c66f00d47d4372c01a4472735f3f740100000094cb4572885f3f74c07d43721656fb0b68c66f00880c4472343b4372403b43720000000000000000 (UID: 00000000-00006960)2e:T619,".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "attrib.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "icacls.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "taskdl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2f:T462,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")30:Tb62,".exe" called "CopyFileA" to copy u.wnry to new location @WanaDecryptor@.exe (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location %USERPROFILE%\Documents\@WanaDecryptor@.exe (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\OneNote Notebooks\My Notebook\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Documents\OneNote Notebooks\My Notebook\@WanaDecryptor@.exe.lnk (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\@WanaDecryptor@.exe.lnk (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location %USERPROFILE%\Documents\Outlook Files\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe.lnk to new location %USERPROFILE%\Documents\Outlook Files\@WanaDecryptor@.exe.lnk (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\@WanaDecryptor@.exe (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\$WINDOWS.~BT\Sources\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\$WINDOWS.~BT\Sources\@WanaDecryptor@.exe (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\found.000\dir0002.chk\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.17134.1_none_fd5fd71a5bf9ba2a\@Please_Read_ (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\found.000\dir0002.chk\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.17134.1_none_fd5fd71a5bf9ba2a\@WanaDecrypto (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @Please_Read_Me@.txt to new location C:\found.000\dir0003.chk\@Please_Read_Me@.txt (UID: 00000000-00006324) ".exe" called "CopyFileW" to copy @WanaDecryptor@.exe to new location C:\found.000\dir0003.chk\@WanaDecryptor@.exe (UID: 00000000-00006324)31:Tf0b,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter MSVCRT.dll (UID: 00000000-00006324) ".exe" called "LoadLibrary" with a parameter MSVCP60.dll (UID: 00000000-00006324) "attrib.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004016) "attrib.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004016) "attrib.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004016) "attrib.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004016) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006632) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006632) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006632) "taskdl.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006632) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006220) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006220) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006220) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006220) "@WanaDecryptor@.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002828) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006960) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006960) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006960) "attrib.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007760) "attrib.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007760) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008024) "taskdl.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000060)32:T99b6,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter InterlockedExchangeAdd (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetEntriesInAclA (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter time (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcscpy (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcscat (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter __CxxFrameHandler (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter swprintf (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _except_handler3 (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcsrchr (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcsncpy (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcscmp (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcschr (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _wfopen (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _ftol (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??0exception@@QAE@ABV0@@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??1exception@@UAE@XZ (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??0exception@@QAE@ABQBD@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter free (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _wcsicmp (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter _local_unwind2 (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter wcsstr (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?_Xran@std@@YAXXZ (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z (UID: 00000000-00006324) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006324) "attrib.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004016) "attrib.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004016) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006632) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006632) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006220) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006220) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00002828) "@WanaDecryptor@.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002828) "cscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006960) "cscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006960) "attrib.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007760) "attrib.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007760) "attrib.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007760) "attrib.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007760) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008024) "taskdl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008024) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008024) "taskdl.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008024) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008024) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008024) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005528) "taskdl.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005528) "taskdl.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000060) "taskdl.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000060) "taskdl.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007312) "taskdl.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007312)33:T49c,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; File: "taskse.exe.539085069") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "10789943069,1836,3135,,CreateProcessA,kernel32.dll,"00:20:16.562",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp")34:T50f,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp")35:T633,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp")36:T13d05,Found reference to API (Indicator: "CloseHandle"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "TerminateProcess"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CreateProcessA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GlobalFree"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetProcAddress"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GlobalAlloc"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetComputerNameW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SetFileTime"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SetFilePointer"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CreateFileA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "ReadFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetFileSize"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "WriteFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SetFileAttributesW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetTempPathW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetFileAttributesA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SizeofResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "LockResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "LoadResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "FindResourceA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "Sleep"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "OpenMutexA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetFullPathNameA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CopyFileA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "VirtualFree"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "FreeLibrary"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "HeapAlloc"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SetLastError"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "VirtualProtect"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "IsBadReadPtr"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "HeapFree"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CreateDirectoryA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "wsprintfA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "RegCloseKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "RegSetValueExA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "RegCreateKeyW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptReleaseContext"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CreateServiceA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CloseServiceHandle"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "StartServiceA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "OpenServiceA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "OpenSCManagerA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "DeleteFileW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "MoveFileExW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "MoveFileW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CreateFileW"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptGenKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptDecrypt"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptEncrypt"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptDestroyKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptImportKey"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "CryptAcquireContextA"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API (Indicator: "TerminateThread"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DrawIcon"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "TabbedTextOutA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GrayStringA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateFontA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetObjectA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "TextOutA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ExtTextOutA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "URLDownloadToFileA"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntry"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "WTSEnumerateSessionsA"; File: "taskse.exe.539085069") Found reference to API (Indicator: "WTSFreeMemory"; File: "taskse.exe.539085069") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "taskse.exe.539085069") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "taskse.exe.539085069") Found reference to API (Indicator: "DuplicateTokenEx"; File: "taskse.exe.539085069") Found reference to API (Indicator: "CreateProcessAsUserA"; File: "taskse.exe.539085069") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "taskse.exe.539085069") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "taskse.exe.539085069") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "taskse.exe.539085069") Found reference to API (Indicator: "WTSQueryUserToken"; File: "taskse.exe.539085069") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "TabbedTextOutA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GrayStringA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "TextOutA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ExtTextOutA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "URLDownloadToFileA"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntry"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00002828.00000000.78184.7E940000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "OpenMutexA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "StartServiceA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API (Indicator: "CryptGenKey"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchangeAdd"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclA"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CryptGetKeyParam"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp, 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp, 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp")37:T789,Found string "cmd.exe /c "%s"" (Indicator: "cmd.exe /c"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found string "%WINDIR%\system32\cmd.exe /c 123901688625357.bat" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c 123901688625357.bat" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "cmd.exe /c "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp") Found string "NDOWS\system32\cmd.exe /c 123901688625357.bat" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp") Found string "NDOWS\system32\cmd.exe /c 123901688625357.bat" (Indicator: "cmd.exe /c"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c" (Indicator: "cmd.exe /c"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp") Found string "cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f" (Indicator: "cmd.exe /c"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found string "cmd.exe /c start /b %s vs" (Indicator: "cmd.exe /c"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp")38:T62c,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp")39:T4f9,Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp")3a:T1f76,"Software\" in Source: 149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin "\REGISTRY\MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\gsvx" in Source: 00000000-00002828.00000000.78184.005C6000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002828.00000000.78184.02C20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\windows\CurrentVersion\Internet Settings" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\windows\CurrentVersion\Internet Settings" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\SQMServiceList" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "Y\MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings" in Source: 00000000-00002828.00000000.78184.048D0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002828.00000000.78184.7E940000.00000002.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006324.00000000.77862.02E20000.00000004.mdmp 00000000-00006324.00000001.79781.02E20000.00000004.mdmp 00000000-00006324.00000002.81701.02E20000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00006324.00000000.77862.02E20000.00000004.mdmp "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006324.00000000.77862.02E20000.00000004.mdmp 00000000-00006324.00000000.77862.1000C000.00000004.mdmp 00000000-00006324.00000001.79781.02E20000.00000004.mdmp 00000000-00006324.00000001.79781.1000C000.00000004.mdmp 00000000-00006324.00000002.81701.02E20000.00000004.mdmp 00000000-00006324.00000002.81701.1000C000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006324.00000000.77862.7F8D0000.00000002.mdmp 00000000-00006324.00000001.79781.7F8D0000.00000002.mdmp 00000000-00006324.00000002.81701.7F8D0000.00000002.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00006324.00000001.79781.02C40000.00000004.mdmp 00000000-00006324.00000002.81701.02C40000.00000004.mdmp3b:T1849,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77420000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77420000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77420000 ".exe" loaded module "KERNEL32" at base 74450000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738c0000 ".exe" loaded module "NTDLL.DLL" at base 77710000 ".exe" loaded module "ADVAPI32.DLL" at base 76520000 ".exe" loaded module "KERNEL32.DLL" at base 74450000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73820000 ".exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76c70000 ".exe" loaded module "USER32.DLL" at base 76300000 ".exe" loaded module "SHELL32.DLL" at base 74b00000 ".exe" loaded module "MSVCRT.DLL" at base 74390000 ".exe" loaded module "MSVCP60.DLL" at base 72620000 ".exe" loaded module "RPCRT4.DLL" at base 77280000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74080000 ".exe" loaded module "SSPICLI.DLL" at base 74130000 "attrib.exe" loaded module "KERNEL32" at base 74450000 "attrib.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77420000 "attrib.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77420000 "attrib.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77420000 "attrib.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74520000 "attrib.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77420000 "attrib.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77420000 "attrib.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77420000 "attrib.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738c0000 "taskdl.exe" loaded module "KERNEL32" at base 74450000 "taskdl.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77420000 "taskdl.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77420000 "taskdl.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77420000 "taskdl.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74520000 "taskdl.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77420000 "taskdl.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77420000 "taskdl.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77420000 "taskdl.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738c0000 "cmd.exe" loaded module "KERNEL32" at base 74450000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77420000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77420000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77420000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74520000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77420000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77420000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77420000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738c0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74450000 "cmd.exe" loaded module "NTDLL.DLL" at base 77710000 "@WanaDecryptor@.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77420000 "@WanaDecryptor@.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77420000 "@WanaDecryptor@.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77420000 "@WanaDecryptor@.exe" loaded module "KERNEL32" at base 74450000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738c0000 "@WanaDecryptor@.exe" loaded module "KERNEL32.DLL" at base 74450000 "@WanaDecryptor@.exe" loaded module "RICHED32.DLL" at base 73810000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73960000 "@WanaDecryptor@.exe" loaded module "COMCTL32.DLL" at base 730f0000 "@WanaDecryptor@.exe" loaded module "COMCTL32" at base 730f0000 "@WanaDecryptor@.exe" loaded module "ADVAPI32.DLL" at base 76520000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72240000 "@WanaDecryptor@.exe" loaded module "RPCRT4.DLL" at base 77280000 "@WanaDecryptor@.exe" loaded module "SSPICLI.DLL" at base 74130000 "@WanaDecryptor@.exe" loaded module "USER32.DLL" at base 76300000 "@WanaDecryptor@.exe" loaded module "MSISO.DLL" at base 721e0000 "@WanaDecryptor@.exe" loaded module "PHONEINFO.DLL" at base 0 "@WanaDecryptor@.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 721c0000 "@WanaDecryptor@.exe" loaded module "WINHTTP.DLL" at base 72110000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 721c0000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72060000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72010000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76c00000 "@WanaDecryptor@.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 71fa0000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77420000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77420000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77420000 "cscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738c0000 "cscript.exe" loaded module "RPCRT4.DLL" at base 77280000 "cscript.exe" loaded module "WLDP.DLL" at base 724c0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 742e0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73820000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74150000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 72470000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\SCROBJ.DLL" at base 72430000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73430000 "cscript.exe" loaded module "NTDLL.DLL" at base 777100003c:T576,"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin" was detected as "Microsoft Linker" and name: "Linker" "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin" was detected as "Zip" and name: "Archive" "@WanaDecryptor@.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "@WanaDecryptor@.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "@WanaDecryptor@.exe" was detected as "Microsoft Linker" and name: "Linker" "@WanaDecryptor@.exe" was detected as "Zip" and name: "Archive" "taskse.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "taskse.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "taskse.exe" was detected as "Microsoft Linker" and name: "Linker" "taskse.exe" was detected as "Zip" and name: "Archive" "taskdl.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "taskdl.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "taskdl.exe" was detected as "Microsoft Linker" and name: "Linker" "taskdl.exe" was detected as "Zip" and name: "Archive"3d:T989,"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x40d488,push 0x4076f4,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x4081c4],pop ecx,or dword ptr [0x40f94c], 0xffffffff,or dword ptr [0x40f950], 0xffffffff,call dword ptr [0x4081c0],mov ecx, dword ptr [0x40f948],mov dword ptr [eax], ecx,call dword ptr [0x4081bc],mov ecx, dword ptr [0x40f944],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4081b8]," "@WanaDecryptor@.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x41baa8,push 0x413050,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x415524],pop ecx,or dword ptr [0x422298], 0xffffffff,or dword ptr [0x42229c], 0xffffffff,call dword ptr [0x415520],mov ecx, dword ptr [0x42228c],mov dword ptr [eax], ecx,call dword ptr [0x41551c],mov ecx, dword ptr [0x422288],mov dword ptr [eax], ecx,mov eax, dword ptr [0x415518]," "taskse.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x402070,push 0x401540,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x402050],pop ecx,or dword ptr [0x4031b4], 0xffffffff,or dword ptr [0x4031b8], 0xffffffff,call dword ptr [0x40204c],mov ecx, dword ptr [0x4031b0],mov dword ptr [eax], ecx,call dword ptr [0x402048],mov ecx, dword ptr [0x4031ac],mov dword ptr [eax], ecx,mov eax, dword ptr [0x402044]," "taskdl.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4020a8,push 0x401a7c,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x40208c],pop ecx,or dword ptr [0x403084], 0xffffffff,or dword ptr [0x403088], 0xffffffff,call dword ptr [0x402088],mov ecx, dword ptr [0x403080],mov dword ptr [eax], ecx,call dword ptr [0x402084],mov ecx, dword ptr [0x40307c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x402080],"3e:T5ac,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "attrib.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "attrib.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "attrib.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "attrib.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "icacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "taskdl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "@WanaDecryptor@.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "@WanaDecryptor@.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "@WanaDecryptor@.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "@WanaDecryptor@.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")3f:Te4a,Observed system executable string:"C:\WINDOWS\SysWOW64\uxtheme.dll" [Source: 00000000-00002828.00000000.78184.00550000.00000004.mdmp] Observed system executable string:"C:\windows\temp\VxSSL32.dll" [Source: 00000000-00002828.00000000.78184.00560000.00000020.mdmp 00000000-00002828.00000000.78184.02C10000.00000002.mdmp] Observed system executable string:"\??\C:\windows\temp\VxOle32.dll" [Source: 00000000-00002828.00000000.78184.005C6000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\ntdll.dll" [Source: 00000000-00002828.00000000.78184.005C6000.00000004.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoa.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\sxsoa.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\GdiPlus.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\GdiPlus.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\comctl32.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoaps.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\sxsoaps.dll" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll.mui" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\SysWOW64\comctl32.dll.mui" [Source: 00000000-00002828.00000000.78184.005D0000.00000002.mdmp] Observed system executable string:"\??\C:\WINDOWS\SysWOW64\OLE32.dll" [Source: 00000000-00002828.00000000.78184.02A28000.00000004.mdmp] Observed system executable string:"\??\C:\WINDOWS\SysWOW64\iertutil.dll" [Source: 00000000-00002828.00000000.78184.02A68000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\ntdll.dll" [Source: 00000000-00002828.00000000.78184.02A90000.00000004.mdmp 00000000-00002828.00000000.78184.02B9C000.00000004.mdmp 00000000-00002828.00000000.78184.02C20000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64.dll" [Source: 00000000-00002828.00000000.78184.02A90000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64win.dll" [Source: 00000000-00002828.00000000.78184.02A90000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\wow64cpu.dll" [Source: 00000000-00002828.00000000.78184.02A90000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\kernelbase.dll" [Source: 00000000-00002828.00000000.78184.02B9C000.00000004.mdmp 00000000-00002828.00000000.78184.02E1E000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\kernel32.dll" [Source: 00000000-00002828.00000000.78184.02B9C000.00000004.mdmp] Observed system executable string:"C:\windows\temp\VxOle32.dll" [Source: 00000000-00002828.00000000.78184.02BF0000.00000020.mdmp 00000000-00002828.00000000.78184.047B0000.00000002.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\apphelp.dll" [Source: 00000000-00002828.00000000.78184.02C20000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNEL32.DLL" [Source: 00000000-00002828.00000000.78184.02C20000.00000004.mdmp]40:T41f,Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00004016) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00007184) Spawned process "taskdl.exe" (UID: 00000000-00006632) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c 123901688625357.bat" (UID: 00000000-00006220) Spawned process "@WanaDecryptor@.exe" with commandline "fi" (UID: 00000000-00002828) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00006960) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00007760) Spawned process "taskdl.exe" (UID: 00000000-00008024) Spawned process "taskdl.exe" (UID: 00000000-00005528) Spawned process "taskdl.exe" (UID: 00000000-00000060) Spawned process "taskdl.exe" (UID: 00000000-00007312) Spawned process "WerFault.exe" with commandline "-u -p 6324 -s 836" (UID: 00000000-00000240) Spawned process "WerFault.exe" with commandline "-u -p 6324 -s 828" (UID: 00000000-00003852)41:T41f,Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00004016) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00007184) Spawned process "taskdl.exe" (UID: 00000000-00006632) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c 123901688625357.bat" (UID: 00000000-00006220) Spawned process "@WanaDecryptor@.exe" with commandline "fi" (UID: 00000000-00002828) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00006960) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00007760) Spawned process "taskdl.exe" (UID: 00000000-00008024) Spawned process "taskdl.exe" (UID: 00000000-00005528) Spawned process "taskdl.exe" (UID: 00000000-00000060) Spawned process "taskdl.exe" (UID: 00000000-00007312) Spawned process "WerFault.exe" with commandline "-u -p 6324 -s 836" (UID: 00000000-00000240) Spawned process "WerFault.exe" with commandline "-u -p 6324 -s 828" (UID: 00000000-00003852)42:T8507,"@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00007184] "TM02835233_fn_Text Sidebar _Annual Report Red and Black design_.docx.WNCRYT" has type "data"- [targetUID: N/A] "taskse.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\taskse.exe]- [targetUID: 00000000-00006324] "taskdl.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\taskdl.exe]- [targetUID: 00000000-00006324] "00000000.eky" has type "data"- Location: [C:\00000000.eky]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jul 6 06:35:57 2023 mtime=Thu Jul 6 06:35:57 2023 atime=Fri May 12 09:22:56 2017 length=245760 window=hide"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00007184] "123901688625357.bat" has type "DOS batch file ASCII text with CRLF CR line terminators"- Location: [C:\123901688625357.bat]- [targetUID: 00000000-00006220] "00000000.pky" has type "b.out pure segmented standalone object file 86 386 Large Text"- Location: [C:\00000000.pky]- [targetUID: 00000000-00006324] "m.vbs" has type "ASCII text with CRLF line terminators"- Location: [C:\m.vbs]- [targetUID: 00000000-00006220] "b.wnry" has type "data"- Location: [C:\b.wnry]- [targetUID: 00000000-00007184] "NEWS.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\NEWS.txt.WNCRYT]- [targetUID: 00000000-00006324] "hwcompat.txt.WNCRYT" has type "data"- Location: [C:\$WINDOWS.~BT\Sources\hwcompat.txt.WNCRYT]- [targetUID: 00000000-00006324] "WelcomeScan.jpg.WNCRYT" has type "data"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT]- [targetUID: 00000000-00006324] "NisLog.txt.WNCRYT" has type "data"- [targetUID: N/A] "SettingsCache.txt.WNCRYT" has type "data"- [targetUID: N/A] "appsglobals.txt.WNCRYT" has type "data"- [targetUID: N/A] "Database1.accdb.WNCRYT" has type "data"- [targetUID: N/A] "Database1.accdb" has type "data"- [targetUID: N/A] "s.wnry" has type "Zip archive data at least v1.0 to extract"- Location: [C:\s.wnry]- [targetUID: 00000000-00006324] "english_wikipedia.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\english_wikipedia.txt.WNCRYT]- [targetUID: 00000000-00006324] "passwords.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt.WNCRYT]- [targetUID: 00000000-00006324] "Outlook.pst.WNCRYT" has type "data"- Location: [%USERPROFILE%\Documents\Outlook Files\Outlook.pst.WNCRYT]- [targetUID: 00000000-00006324] "Outlook.pst" has type "DOS executable (COM)"- [targetUID: N/A] "us_tv_and_film.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\us_tv_and_film.txt.WNCRYT]- [targetUID: 00000000-00006324] "cmath_testcases.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cmath_testcases.txt.WNCRYT]- [targetUID: 00000000-00006324] "AppCache133331238943058202.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133331238943058202.txt.WNCRYT]- [targetUID: 00000000-00006324] "appssynonyms.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appssynonyms.txt.WNCRYT]- [targetUID: 00000000-00006324] "0.0.filtertrie.intermediate.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{57a7a470-2f24-4efa-9fd4-d18914267563}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] "0.0.filtertrie.intermediate.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2914871c-12b8-49a8-87b7-27e43148a1ce}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] "m_vietnamese.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_vietnamese.wnry]- [targetUID: 00000000-00006324] "m_korean.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_korean.wnry]- [targetUID: 00000000-00006324] "surnames.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\surnames.txt.WNCRYT]- [targetUID: 00000000-00006324] "settingssynonyms.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\settingssynonyms.txt.WNCRYT]- [targetUID: 00000000-00006324] "m_japanese.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_japanese.wnry]- [targetUID: 00000000-00006324] "m_chinese _traditional_.wnry" has type "Rich Text Format data version 1 unknown character set"- [targetUID: N/A] "t.wnry" has type "data"- [targetUID: 00000000-00006324] "NEWS.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\NEWS.txt.WNCRYT]- [targetUID: 00000000-00006324] "m_chinese _simplified_.wnry" has type "Rich Text Format data version 1 unknown character set"- [targetUID: N/A] "data.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\EADPData Component\4.0.2.16\data.txt.WNCRYT]- [targetUID: 00000000-00006324] "m_romanian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_romanian.wnry]- [targetUID: 00000000-00007184] "m_greek.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_greek.wnry]- [targetUID: 00000000-00006324] "m_bulgarian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_bulgarian.wnry]- [targetUID: 00000000-00007184] "m_russian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_russian.wnry]- [targetUID: 00000000-00006324] "bg_g.jpg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\bg_g.jpg.WNCRYT]- [targetUID: 00000000-00006324] "m_turkish.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_turkish.wnry]- [targetUID: 00000000-00006324] "revocations.txt.WNCRYT" has type "data"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\revocations.txt.WNCRYT]- [targetUID: 00000000-00006324] "m_slovak.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_slovak.wnry]- [targetUID: 00000000-00006324] "m_latvian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_latvian.wnry]- [targetUID: 00000000-00006324] "settingsglobals.txt.WNCRYT" has type "data"- [targetUID: N/A] "m_czech.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_czech.wnry]- [targetUID: 00000000-00007184] "m_polish.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_polish.wnry]- [targetUID: 00000000-00006324] "m_croatian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_croatian.wnry]- [targetUID: 00000000-00007184] "m_swedish.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_swedish.wnry]- [targetUID: 00000000-00006324] "m_french.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_french.wnry]- [targetUID: 00000000-00006324] "m_finnish.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_finnish.wnry]- [targetUID: 00000000-00006324] "CachedImage_1024_611_POS4.jpg.WNCRYT" has type "data"- [targetUID: N/A] "m_portuguese.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_portuguese.wnry]- [targetUID: 00000000-00006324] "m_filipino.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_filipino.wnry]- [targetUID: 00000000-00006324] "m_norwegian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_norwegian.wnry]- [targetUID: 00000000-00006324] "m_spanish.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_spanish.wnry]- [targetUID: 00000000-00006324] "m_indonesian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_indonesian.wnry]- [targetUID: 00000000-00007184] "m_german.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_german.wnry]- [targetUID: 00000000-00006324] "m_danish.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_danish.wnry]- [targetUID: 00000000-00006324] "m_dutch.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_dutch.wnry]- [targetUID: 00000000-00006324] "m_english.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_english.wnry]- [targetUID: 00000000-00006324] "m_italian.wnry" has type "Rich Text Format data version 1 unknown character set"- Location: [C:\msg\m_italian.wnry]- [targetUID: 00000000-00006324] "LICENSE.txt.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "settingsconversions.txt.WNCRYT" has type "data"- [targetUID: N/A] "appsconversions.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appsconversions.txt.WNCRYT]- [targetUID: 00000000-00006324] "female_names.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\female_names.txt.WNCRYT]- [targetUID: 00000000-00006324] "NEWS2x.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\NEWS2x.txt.WNCRYT]- [targetUID: 00000000-00006324] "license.txt.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "math_testcases.txt.WNCRYT" has type "data"- [targetUID: N/A] "0.0.filtertrie.intermediate.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f3fcdbe0-d1a5-4f5e-99d9-2e15fff0407e}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] "0.0.filtertrie.intermediate.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1d6692aa-cfb0-4b91-98e2-167755c4568a}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] "0.0.filtertrie.intermediate.txt.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "floating_points.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\floating_points.txt.WNCRYT]- [targetUID: 00000000-00006324] "db931a59.jpg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Notifications\wpnidm\db931a59.jpg.WNCRYT]- [targetUID: 00000000-00006324] "README.txt.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "HISTORY.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\HISTORY.txt.WNCRYT]- [targetUID: 00000000-00006324] "a2e35824.jpg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Notifications\wpnidm\a2e35824.jpg.WNCRYT]- [targetUID: 00000000-00006324] "msg_43.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_43.txt.WNCRYT]- [targetUID: 00000000-00006324] "Grammar.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\lib2to3\Grammar.txt.WNCRYT]- [targetUID: 00000000-00006324] "el.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "TODO.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\TODO.txt.WNCRYT]- [targetUID: 00000000-00006324] "formatfloat_testcases.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\formatfloat_testcases.txt.WNCRYT]- [targetUID: 00000000-00006324] "male_names.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\male_names.txt.WNCRYT]- [targetUID: 00000000-00006324] "ru.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\msgs\ru.msg.WNCRYT]- [targetUID: 00000000-00006324] "nl.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\nl.msg.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2" has type "data"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2]- [targetUID: 00000000-00007184] "msg_13.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_13.txt.WNCRYT]- [targetUID: 00000000-00006324] "msg_07.txt.WNCRYT" has type "data"- [targetUID: N/A] "msg_16.txt.WNCRYT" has type "data"- [targetUID: N/A] "msg_25.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_25.txt.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "readme.txt.WNCRYT" has type "data"- [targetUID: N/A] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "pl.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "de.msg.WNCRYT" has type "data"- [targetUID: N/A] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\User\Document Themes\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\User\SmartArt Graphics\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2" has type "data"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\OneNote 2010 Guide\Open Notebook.onetoc2]- [targetUID: 00000000-00007184] "hu.msg.WNCRYT" has type "data"- [targetUID: N/A] "da7eb59e.jpg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Notifications\wpnidm\da7eb59e.jpg.WNCRYT]- [targetUID: 00000000-00006324] "nl.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "WmDefault.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\pref\WmDefault.txt.WNCRYT]- [targetUID: 00000000-00006324] "brndlog.txt.WNCRYT" has type "data"- [targetUID: N/A] "cs.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\msgs\cs.msg.WNCRYT]- [targetUID: 00000000-00006324] "es.msg.WNCRYT" has type "data"- [targetUID: N/A] "eo.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\msgs\eo.msg.WNCRYT]- [targetUID: 00000000-00006324] "pt.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "da.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "en.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\en.msg.WNCRYT]- [targetUID: 00000000-00006324] "sv.msg.WNCRYT" has type "data"- [targetUID: N/A] "fr.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "it.msg.WNCRYT" has type "data"- [targetUID: N/A] "extend.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\extend.txt.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\Managed\Document Themes\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "Open Notebook.onetoc2.WNCRYT" has type "data"- Location: [%APPDATA%\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\Open Notebook.onetoc2.WNCRYT]- [targetUID: 00000000-00006324] "ieee754.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\ieee754.txt.WNCRYT]- [targetUID: 00000000-00006324] "en.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "zh.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\zh.msg.WNCRYT]- [targetUID: 00000000-00006324] "SiteSecurityServiceState.txt.WNCRYT" has type "data"- Location: [%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\SiteSecurityServiceState.txt.WNCRYT]- [targetUID: 00000000-00006324] "tokenize_tests.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\tokenize_tests.txt.WNCRYT]- [targetUID: 00000000-00006324] "msg_02.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_02.txt.WNCRYT]- [targetUID: 00000000-00006324] "entry_points.txt.WNCRYT" has type "data"- [targetUID: N/A] "msg_38.txt.WNCRYT" has type "data"- [targetUID: N/A] "exception_hierarchy.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\exception_hierarchy.txt.WNCRYT]- [targetUID: 00000000-00006324] "th.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\th.msg.WNCRYT]- [targetUID: 00000000-00006324] "bn.msg.WNCRYT" has type "data"- [targetUID: N/A] "el.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\el.msg.WNCRYT]- [targetUID: 00000000-00006324] "CREDITS.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\CREDITS.txt.WNCRYT]- [targetUID: 00000000-00006324] "uk.msg.WNCRYT" has type "data"- [targetUID: N/A] "te.msg.WNCRYT" has type "data"- [targetUID: N/A] "mk.msg.WNCRYT" has type "data"- [targetUID: N/A] "be.msg.WNCRYT" has type "data"- [targetUID: N/A] "msg_26.txt.WNCRYT" has type "data"- [targetUID: N/A] "sr.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\sr.msg.WNCRYT]- [targetUID: 00000000-00006324] "ru.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "ar.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\ar.msg.WNCRYT]- [targetUID: 00000000-00006324] "fa_in.msg.WNCRYT" has type "data"- [targetUID: N/A] "kok.msg.WNCRYT" has type "data"- [targetUID: N/A] "he.msg.WNCRYT" has type "data"- [targetUID: N/A] "msg_39.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_39.txt.WNCRYT]- [targetUID: 00000000-00006324] "msg_22.txt.WNCRYT" has type "data"- [targetUID: N/A] "ta.msg.WNCRYT" has type "data"- [targetUID: N/A] "bg.msg.WNCRYT" has type "data"- [targetUID: N/A] "ar_lb.msg.WNCRYT" has type "data"- [targetUID: N/A] "ar_sy.msg.WNCRYT" has type "data"- [targetUID: N/A] "ar_jo.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\ar_jo.msg.WNCRYT]- [targetUID: 00000000-00006324] "mr.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\mr.msg.WNCRYT]- [targetUID: 00000000-00006324] "hi.msg.WNCRYT" has type "data"- [targetUID: N/A] "fa.msg.WNCRYT" has type "data"- [targetUID: N/A] "ja.msg.WNCRYT" has type "data"- [targetUID: N/A] "ko.msg.WNCRYT" has type "data"- [targetUID: N/A] "License.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32com\License.txt.WNCRYT]- [targetUID: 00000000-00006324] "license.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\win32\license.txt.WNCRYT]- [targetUID: 00000000-00006324] "license.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pythonwin\license.txt.WNCRYT]- [targetUID: 00000000-00006324] "LICENSE.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\colorama-0.4.6.dist-info\licenses\LICENSE.txt.WNCRYT]- [targetUID: 00000000-00006324] "vi.msg.WNCRYT" has type "data"- [targetUID: N/A] "cs.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "sq.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\sq.msg.WNCRYT]- [targetUID: 00000000-00006324] "top_level.txt.WNCRYT" has type "data"- [targetUID: N/A] "is.msg.WNCRYT" has type "data"- [targetUID: N/A] "msg_15.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_15.txt.WNCRYT]- [targetUID: 00000000-00006324] "lt.msg.WNCRYT" has type "data"- [targetUID: N/A] "mailcap.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\mailcap.txt.WNCRYT]- [targetUID: 00000000-00006324] "eo.msg.WNCRYT" has type "data"- [targetUID: 00000000-00006324] "de_be.msg.WNCRYT" has type "data"- [targetUID: N/A] "lv.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\lv.msg.WNCRYT]- [targetUID: 00000000-00006324] "fr.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\fr.msg.WNCRYT]- [targetUID: 00000000-00006324] "et.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\et.msg.WNCRYT]- [targetUID: 00000000-00006324] "sk.msg.WNCRYT" has type "data"- [targetUID: N/A] "pl.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\pl.msg.WNCRYT]- [targetUID: 00000000-00006324] "ro.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\ro.msg.WNCRYT]- [targetUID: 00000000-00006324] "sh.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\sh.msg.WNCRYT]- [targetUID: 00000000-00006324] "nb.msg.WNCRYT" has type "data"- [targetUID: N/A] "da.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\da.msg.WNCRYT]- [targetUID: 00000000-00006324] "sl.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\sl.msg.WNCRYT]- [targetUID: 00000000-00006324] "nn.msg.WNCRYT" has type "data"- [targetUID: N/A] "fi.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\fi.msg.WNCRYT]- [targetUID: 00000000-00006324] "ga.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\ga.msg.WNCRYT]- [targetUID: 00000000-00006324] "tr.msg.WNCRYT" has type "data"- [targetUID: N/A] "hr.msg.WNCRYT" has type "data"- [targetUID: N/A] "pt.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\pt.msg.WNCRYT]- [targetUID: 00000000-00006324] "ca.msg.WNCRYT" has type "data"- [targetUID: N/A] "shift_jisx0213-utf8.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\shift_jisx0213-utf8.txt.WNCRYT]- [targetUID: 00000000-00006324] "euc_jisx0213-utf8.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\euc_jisx0213-utf8.txt.WNCRYT]- [targetUID: 00000000-00006324] "README.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\leakers\README.txt.WNCRYT]- [targetUID: 00000000-00006324] "gb18030-utf8.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\gb18030-utf8.txt.WNCRYT]- [targetUID: 00000000-00006324] "nl.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\nl.msg.WNCRYT]- [targetUID: 00000000-00006324] "LICENSE.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\urllib3-1.26.13.dist-info\LICENSE.txt.WNCRYT]- [targetUID: 00000000-00006324] "LICENSE.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\site-packages\pip-22.3.dist-info\LICENSE.txt.WNCRYT]- [targetUID: 00000000-00006324] "euc_jp-utf8.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\euc_jp-utf8.txt.WNCRYT]- [targetUID: 00000000-00006324] "shift_jis-utf8.txt.WNCRYT" has type "data"- [targetUID: N/A] "iso2022_jp-utf8.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\iso2022_jp-utf8.txt.WNCRYT]- [targetUID: 00000000-00006324] "gv.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\gv.msg.WNCRYT]- [targetUID: 00000000-00006324] "msg_06.txt.WNCRYT" has type "data"- [targetUID: N/A] "gbk-utf8.txt.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cjkencodings\gbk-utf8.txt.WNCRYT]- [targetUID: 00000000-00006324] "kl.msg.WNCRYT" has type "data"- [targetUID: N/A] "eu.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\eu.msg.WNCRYT]- [targetUID: 00000000-00006324] "fo.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\fo.msg.WNCRYT]- [targetUID: 00000000-00006324] "sw.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\sw.msg.WNCRYT]- [targetUID: 00000000-00006324] "af.msg.WNCRYT" has type "data"- Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\msgs\af.msg.WNCRYT]- [targetUID: 00000000-00006324] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00007184] "r.wnry" has type "ASCII text with CRLF line terminators"- Location: [C:\r.wnry]- [targetUID: 00000000-00006324] "c.wnry" has type "data"- Location: [C:\c.wnry]- [targetUID: 00000000-00007184] "00000000.res" has type "data"- Location: [C:\00000000.res]- [targetUID: 00000000-00006324] "f.wnry" has type "ASCII text with CRLF line terminators"- Location: [C:\f.wnry]- [targetUID: 00000000-00006324] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\found.000\dir0012.chk\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\$WINDOWS.~BT\Sources\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\found.000\dir0003.chk\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jul 6 06:35:57 2023 mtime=Thu Jul 6 06:35:57 2023 atime=Fri May 12 09:22:56 2017 length=245760 window=hide"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows Live\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jul 6 06:35:57 2023 mtime=Thu Jul 6 06:35:57 2023 atime=Fri May 12 09:22:56 2017 length=245760 window=hide"- Location: [C:\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jul 6 06:35:57 2023 mtime=Thu Jul 6 06:35:57 2023 atime=Fri May 12 09:22:56 2017 length=245760 window=hide"- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Thu Jul 6 06:35:57 2023 mtime=Thu Jul 6 06:35:57 2023 atime=Fri May 12 09:22:56 2017 length=245760 window=hide"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk]- [targetUID: 00000000-00007184] "u.wnry" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\u.wnry]- [targetUID: 00000000-00006324] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows Defender\Scans\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\Network\Downloader\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\User Account Pictures\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows Live\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%USERPROFILE%\Documents\OneNote Notebooks\My Notebook\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\AppV\Setup\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\found.000\dir0005.chk\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Caches\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\found.000\dir0006.chk\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\$WINDOWS.~BT\Sources\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [%ALLUSERSPROFILE%\Microsoft\Diagnosis\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184] "@Please_Read_Me@.txt" has type "ASCII text with CRLF line terminators"- Location: [C:\found.000\dir0003.chk\@Please_Read_Me@.txt]- [targetUID: 00000000-00007184]43:T6d6,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TASKDL.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\TASKDL.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "")44:T9bc,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "PENDINGFILERENAMEOPERATIONS2"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\TASKDL.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "")45:T9c1,".exe" touched file "C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Projects\~SDC7AB.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\~SDC7AB.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\~SDC7BC.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\~SDC8EC.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\~SDC90C.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\~SDC90C.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\Downlevel\~SDCA07.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\Downlevel\~SDCA07.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\Families\~SDCA18.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\Families\~SDCA18.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\~SDCA19.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCA97.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCA97.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCA98.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCA98.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCAA8.tmp" ".exe" touched file "C:\Users\All Users\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCAA9.tmp" ".exe" touched file "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.16299.15_neutral_neutral_cw5n1h2txyewy\~SDCAA9.tmp"46:T9e7,".exe" trying to access LNK file "C:\@WANADECRYPTOR@.EXE.LNK" ".exe" trying to access LNK file "C:\@WanaDecryptor@.exe.lnk" ".exe" trying to access LNK file "%USERPROFILE%\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk" "icacls.exe" trying to access LNK file "C:\@WANADECRYPTOR@.EXE.LNK" "cscript.exe" trying to access LNK file "C:\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%USERPROFILE%\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\UEV\Scripts\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Live\@WanaDecryptor@.exe.lnk" "cscript.exe" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows Live\@WanaDecryptor@.exe.lnk"47:T6c1,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\ATTRIB.EXE" ".exe" trying to access non-existent file "C:\attrib.exe" ".exe" trying to access non-existent file "attrib.exe" ".exe" trying to access non-existent file "C:\ICACLS.EXE" ".exe" trying to access non-existent file "C:\icacls.exe" ".exe" trying to access non-existent file "icacls.exe" ".exe" trying to access non-existent file "C:\CRYPTSP.DLL" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\bcrypt.dll" ".exe" trying to access non-existent file "C:\CRYPT32.DLL" ".exe" trying to access non-existent file "C:\crypt32.dll" ".exe" trying to access non-existent file "C:\MSVCP60.DLL" ".exe" trying to access non-existent file "C:\MSVCP60.dll" ".exe" trying to access non-existent file "C:\@WANADECRYPTOR@.EXE" ".exe" trying to access non-existent file "C:\@WanaDecryptor@.exe" "attrib.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "taskdl.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "taskdl.exe" trying to access non-existent file "C:\MSVCP60.DLL" "taskdl.exe" trying to access non-existent file "C:\FLTLIB.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"48:T90c,".exe" trying to access non-existent file "C:\C.WNRY" ".exe" trying to access non-existent file "C:\c.wnry" ".exe" trying to access non-existent file "C:\MSG" ".exe" trying to access non-existent file "C:\msg" ".exe" trying to access non-existent file "C:\00000000.DKY" ".exe" trying to access non-existent file "C:\00000000.dky" ".exe" trying to access non-existent file "C:\00000000.pky" ".exe" trying to access non-existent file "C:\00000000.res" ".exe" trying to access non-existent file "C:\F.WNRY" ".exe" trying to access non-existent file "C:\f.wnry" ".exe" trying to access non-existent file "C:\@WANADECRYPTOR@.EXE.LNK" ".exe" trying to access non-existent file "C:\@WanaDecryptor@.exe.lnk" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WNCRY" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\Documents\OneNote Notebooks\OneNote 2010 Guide\OPEN NOTEBOOK.ONETOC2.WNCRY" ".exe" trying to access non-existent file "Z:\" ".exe" trying to access non-existent file "Z:\$RECYCLE" ".exe" trying to access non-existent file "Z:\$RECYCLE\" ".exe" trying to access non-existent file "C:\$WINDOWS.~BT\Sources\HWCOMPAT.TXT.WNCRY" ".exe" trying to access non-existent file "C:\$WINDOWS.~BT\Sources\hwcompat.txt.WNCRY" ".exe" trying to access non-existent file "C:\$WINDOWS.~BT\Sources\HWCOMPAT.TXT.WNCRYT" ".exe" trying to access non-existent file "C:\Users\Dske9oE\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.16\data.txt.WNCRY" ".exe" trying to access non-existent file "C:\Users\Dske9oE\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\english_wikipedia.txt.WNCRY" ".exe" trying to access non-existent file "C:\Users\Dske9oE\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\male_names.txt.WNCRY" ".exe" trying to access non-existent file "C:\Users\Dske9oE\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\surnames.txt.WNCRY"49:T5e6,Heuristic match: "ax.iD" Heuristic match: ";D.aX" Heuristic match: "~U.NeT" Pattern match: "http://%d/%d/%d" Pattern match: "PLa-2.mAe/dk#" Pattern match: "V.zf/Jqle~@p7lg5V5Z$P*E" Pattern match: "m.wkP/-vg}o'1lwOgnK82c#E`ZZayN!rK,bi-y/6fr*v:1yD:7G3z8jTChS^@~D-kKYmK/F%_wg$TA;O1#LGC" Pattern match: "N.FsL/+`Lu0d#W|Z0\jkKDKGKi-w,K-4:@iJ?2?kY6/?k\Z:2uVG-DB`yqi?nmP4E[Jjg_/y" Pattern match: "TMzK.HX/Xe`@r}OHSJ/9^a" Pattern match: "zXL.GG/$Id^qBOP5-iy" Heuristic match: "WANACRY!#bS(9M`+;fh4A\F!qt&\{*(-dqV}N3yk.c}$2FIu,#d%^M<%qSWDxu':E:;i>&=|L*(]^P]0\hMmnnfYy~&P#i}c.4CI)\vf;8!/0/7lq[M87" Pattern match: "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip" Pattern match: "http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s" Pattern match: "https://en.wikipedia.org/wiki/Bitcoin" Pattern match: "https://www.google.com/search?q=how+to+buy+bitcoin" Heuristic match: "dist.torproject.org" Pattern match: ".msftc0nnecttest.com/redirect" Pattern match: "dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip" Heuristic match: "torproject.org" Pattern match: "https://dist.torproject.org/" Heuristic match: "ist.torproject.org" Heuristic match: "orproject.org" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "-L.vi" Heuristic match: "0g.Hn" Heuristic match: "scout.com" Heuristic match: "rediff.com"4a:Tb3e,Found URL "https://" - Source: "00000000-00006324.00000002.81701.054E2000.00000004.mdmp") Found URL "https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274-" - Source: "00000000-00006324.00000002.81701.054E2000.00000004.mdmp") Found URL "https://www.w3.org/tr/xml/" - Source: "00000000-00006324.00000002.81701.054E2000.00000004.mdmp") Found URL "https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip00000000.res00000000.pky00000000.eky" - Source: "00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006960.00000000.78563.737F1000.00000020.mdmp")4b:T791,".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\* (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00006324) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\* (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter Database1.accdb (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter My Music (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter My Pictures (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter My Videos (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter OneNote Notebooks (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter Outlook Files (UID: 00000000-00006324) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\My Music\* (UID: 00000000-00006324) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\My Pictures\* (UID: 00000000-00006324) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\My Videos\* (UID: 00000000-00006324) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\OneNote Notebooks\* (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter My Notebook (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter OneNote 2010 Guide (UID: 00000000-00006324) ".exe" called "FindNextFileW" with parameter Unfiled Notes.one (UID: 00000000-00006324) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\OneNote Notebooks\My Notebook\* (UID: 00000000-00006324)4c:Tb66,Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found string "7naesu" (Indicator: "aes"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") file/memory contains long string with (Indicator: "aes"; File: "@WanaDecryptor@.exe") file/memory contains long string with (Indicator: "rsa2"; File: "@WanaDecryptor@.exe") file/memory contains long string with (Indicator: "aes"; File: "SettingsCache.txt.WNCRYT") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found string ".aes" (Indicator: "aes"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp") Found string "t Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp") Found string "RSA2" (Indicator: "rsa2"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp") Found string "sundaes" (Indicator: "aes"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "anaesthetic" (Indicator: "aes"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "chacha1" (Indicator: "chacha"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "maestro1" (Indicator: "aes"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "aessedai" (Indicator: "aes"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "muchacha" (Indicator: "chacha"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp")4d:T891,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp")4e:T1136,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "82806473370,1836,3111,,FindFirstFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82837638950,1836,3111,,FindFirstFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82825237779,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82734687908,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.531",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82827087652,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "83084932102,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.671",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82727001654,1836,3111,,FindFirstFileW,kernel32.dll,"00:20:46.515",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82815377371,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82804242431,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82834970181,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82846682047,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.578",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82835783843,1836,3113,,FindNextFileW,kernel32.dll,"00:20:46.562",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82796206302,1836,3111,,FindFirstFileW,kernel32.dll,"00:20:46.546",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp") Found reference to API "82779738704,1836,3111,,FindFirstFileW,kernel32.dll,"00:20:46.546",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp")4f:T1679,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")50:T403,Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")51:T73d,Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "taskse.exe.539085069") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API ",3162,,GetUserNameW,advapi32" (Indicator: "GetUserName"; Source: "00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp")52:T75a,Found string "C:\Users\Dske9oE\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt" (Indicator: "password"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp") Found string "secretly" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "secretive" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "secretaries" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "secretions" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "secretarial" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "temppassword" (Indicator: "password"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "password21" (Indicator: "password"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "secret2" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "passwordstandard" (Indicator: "password"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "password!" (Indicator: "password"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "password22" (Indicator: "password"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "1secret" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "itsasecret" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp") Found string "secreta" (Indicator: "secret"; Source: "00000000-00006324.00000001.79781.054E2000.00000004.mdmp")53:Tbbe,Found string "%USERPROFILE%\Microsoft\Device Stage\Device\*" (Indicator: "\Device\"; Source: "00000000-00006324-00000C27-38944811287") Found string "%USERPROFILE%\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\*" (Indicator: "\Device\"; Source: "00000000-00006324-00000C27-39025062841") Found string "%USERPROFILE%\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\*" (Indicator: "\Device\"; Source: "00000000-00006324-00000C27-39039119079") Found string "%USERPROFILE%\Microsoft\Windows\ClipSVC\Install\Device\*" (Indicator: "\Device\"; Source: "00000000-00006324-00000C27-49477435361") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002828.00000000.78184.02C20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\@WanaDecryptor@.exe" (Indicator: "\Device\"; Source: "00000000-00006324.00000000.77862.008A8000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\@WanaDecryptor@.exe.lnk" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.008A8000.00000004.mdmp, 00000000-00006324.00000002.81701.008A8000.00000004.mdmp") Found string ":\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp") Found string ":\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp") Found string ":\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp") Found string ":\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp") Found string ":\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp") Found string ":\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png" (Indicator: "\Device\"; Source: "00000000-00006324.00000001.79781.04AE0000.00000004.mdmp, 00000000-00006324.00000002.81701.04AE0000.00000004.mdmp")54:T4fa,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")55:Tada,Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "taskse.exe.539085069") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "taskse.exe.539085069") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")56:T481,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002828.00000000.78184.00415000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")57:Tb28,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\TASKDL.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\ATTRIB.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\ICACLS.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\@WANADECRYPTOR@.EXE"; Value: "") "attrib.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "icacls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CSCRIPT.EXE"; Value: "") "@WanaDecryptor@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "@WanaDecryptor@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "@WanaDecryptor@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "@WanaDecryptor@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "@WanaDecryptor@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "@WanaDecryptor@.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "")58:T475,Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp")59:T130f,Dropped file: "NEWS.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\NEWS.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "english_wikipedia.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\english_wikipedia.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "passwords.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\passwords.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "us_tv_and_film.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\us_tv_and_film.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "cmath_testcases.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\cmath_testcases.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "AppCache133331238943058202.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133331238943058202.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "appssynonyms.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appssynonyms.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "0.0.filtertrie.intermediate.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{57a7a470-2f24-4efa-9fd4-d18914267563}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "0.0.filtertrie.intermediate.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2914871c-12b8-49a8-87b7-27e43148a1ce}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "surnames.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\surnames.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "settingssynonyms.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\settingssynonyms.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "NEWS.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\NEWS.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "data.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\EADPData Component\4.0.2.16\data.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "bg_g.jpg.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\bg_g.jpg.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "revocations.txt.WNCRYT" - Location: [%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\revocations.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "appsconversions.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{876a2545-4fc1-4b0b-a03d-f04cb0b30ad1}\appsconversions.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "female_names.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\ZxcvbnData\3.0.0.0\female_names.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "NEWS2x.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\NEWS2x.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "0.0.filtertrie.intermediate.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f3fcdbe0-d1a5-4f5e-99d9-2e15fff0407e}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "0.0.filtertrie.intermediate.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1d6692aa-cfb0-4b91-98e2-167755c4568a}\0.0.filtertrie.intermediate.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "floating_points.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\floating_points.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "db931a59.jpg.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Notifications\wpnidm\db931a59.jpg.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "HISTORY.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\idlelib\HISTORY.txt.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "a2e35824.jpg.WNCRYT" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Notifications\wpnidm\a2e35824.jpg.WNCRYT]- [targetUID: 00000000-00006324] Dropped file: "msg_43.txt.WNCRYT" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\test\test_email\data\msg_43.txt.WNCRYT]- [targetUID: 00000000-00006324]5a:T445,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "attrib.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "attrib.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "icacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "taskdl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "@WanaDecryptor@.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "@WanaDecryptor@.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")5b:T4d6,"@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: 00000000-00007184] "taskse.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\taskse.exe]- [targetUID: 00000000-00006324] "taskdl.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\taskdl.exe]- [targetUID: 00000000-00006324] "Outlook.pst" has type "DOS executable (COM)"- [targetUID: N/A] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\found.000\dir0012.chk\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\$WINDOWS.~BT\Sources\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "@WanaDecryptor@.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\found.000\dir0003.chk\@WanaDecryptor@.exe]- [targetUID: 00000000-00007184] "u.wnry" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\u.wnry]- [targetUID: 00000000-00006324]5c:T432,".exe" wrote 16384 bytes starting with PE header signature to file "C:\taskdl.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 16384 bytes starting with PE header signature to file "C:\taskse.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 16384 bytes starting with PE header signature to file "C:\u.wnry": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5d:T913,"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window." (Source: @Please_Read_Me@.txt, Indicator: "decrypt your files") "Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named "%s". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window." (Source: r.wnry, Indicator: "decrypt your files") "Ooops, your files have been encrypted!" (Source: 00000000-00002828.00000000.78184.00423000.00000002.mdmp, Indicator: "files have been encrypted") "oops, your files have been encrypted!" (Source: 00000000-00002828.00000000.78184.032B0000.00000002.mdmp, Indicator: "files have been encrypted") "ur files have been encrypted!" (Source: 00000000-00006324.00000001.79781.034C0000.00000002.mdmp, 00000000-00006324.00000002.81701.034C0000.00000002.mdmp, Indicator: "files have been encrypted")5e:T5c8,".exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00006324) ".exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00006324) ".exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006324) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00006632) "taskdl.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00006632) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00006632) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00008024) "taskdl.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00008024) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00008024) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00005528) "taskdl.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00005528) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00005528) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00000060) "taskdl.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00000060) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00000060) "taskdl.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00007312) "taskdl.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00007312) "taskdl.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00007312)5f:Te64,".exe" marked "C:\found.000\dir0000.chk\~SDB270.tmp" for deletion ".exe" marked "C:\found.000\dir0001.chk\~SDB271.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_sv-se_2ae7596c734874f0\~SDB805.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_tr-tr_d3f4a3b3620476e1\~SDB816.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_a551c1b1123c4900\~SDB817.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.17134.1_none_9b0594449c86f8b6\~SDB818.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.17134.1_none_8d5c6e74852bd57a\~SDB82B.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_it-it_5d2183bca3433c4b\~SDB925.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_ff4702c9965e4e26\~SDB936.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_a2b0df7e88cf153c\~SDB937.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_467c0b7f7af6e0d9\~SDB938.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_sk-sk_b8b2d6f41f373c97\~SDB94D.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_sr-..-rs_5df560f094e2f6ab\~SDB95E.tmp" for deletion ".exe" marked "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_sv-se_b592bcbc214654c8\~SDB95F.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\AppV\~SDBDA3.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\AppV\Setup\~SDBDB4.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\DRM\Server\~SDBFA2.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\EdgeUpdate\Log\~SDBFC3.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_AcroRd32.exe_6dee146439ff91da44f47ca6c182513a9aa6c7d_b1cc57ae_1940f21f\~SDD28B.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Critical_10.0.16299.245_1_48794680612665bb82de33bec37d035383da8_00000000_07724d5b\~SDD2A0.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.15_67766fb97a1eea31719417e8f6de1527aa76559c_00000000_1b1d83da\~SDD2E0.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\~SDD5DC.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\~SDD60C.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\25\~SDD632.tmp" for deletion ".exe" marked "C:\ProgramData\Microsoft\Windows Defender\Scans\MetaStore\2\88\~SDD654.tmp" for deletion60:Td21,".exe" opened "C:\00000000.res" with delete access ".exe" opened "C:\$Recycle.Bin\S-1-5-18\~SDB080.tmp" with delete access ".exe" opened "C:\$WINDOWS.~BT\Sources\hwcompat.txt.WNCRYT" with delete access ".exe" opened "C:\$WINDOWS.~BT\Sources\HWCOMPAT.TXT.WNCRYT" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_sv-se_2ae7596c734874f0\~SDB805.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_10.0.17134.1_zh-cn_a551c1b1123c4900\~SDB817.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.17134.1_none_9b0594449c86f8b6\~SDB818.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.17134.1_none_8d5c6e74852bd57a\~SDB82B.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-com-complus-runtime_31bf3856ad364e35_10.0.17134.1_none_3f4b4b693ddbf374\~SDB82D.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_hu-hu_ba6a0dbdb07125e9\~SDB924.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ja-jp_ff4702c9965e4e26\~SDB936.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_ko-kr_a2b0df7e88cf153c\~SDB937.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_lt-lt_467c0b7f7af6e0d9\~SDB938.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_lv-lv_47497a037a7521c9\~SDB939.tmp" with delete access ".exe" opened "C:\found.000\dir0002.chk\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.17134.1_nb-no_8b4360b360f440f8\~SDB93A.tmp" with delete access ".exe" opened "C:\found.000\dir0006.chk\~SDBAA5.tmp" with delete access ".exe" opened "C:\ProgramData\Microsoft\AppV\~SDBDA3.tmp" with delete access ".exe" opened "C:\Users\All Users\MICROSOFT\APPV\SETUP\~SDBDB4.TMP" with delete access ".exe" opened "C:\ProgramData\Microsoft\AppV\Setup\~SDBDB4.tmp" with delete access ".exe" opened "C:\Users\All Users\MICROSOFT\DEVICE STAGE\TASK\{07DEB856-FC6E-4FB9-8ADD-D8F2CF8722C9}\EN-US\~SDBEDE.TMP" with delete access ".exe" opened "C:\Users\All Users\MICROSOFT\DRM\SERVER\~SDBFA2.TMP" with delete access ".exe" opened "C:\ProgramData\Microsoft\DRM\Server\~SDBFA2.tmp" with delete access ".exe" opened "C:\Users\All Users\MICROSOFT\EDGEUPDATE\~SDBFC2.TMP" with delete access ".exe" opened "C:\ProgramData\Microsoft\EdgeUpdate\~SDBFC2.tmp" with delete access ".exe" opened "C:\Users\All Users\MICROSOFT\EDGEUPDATE\LOG\~SDBFC3.TMP" with delete access61:T1024,".exe" wrote bytes "b00a547660005476" to virtual address "0x775CE018" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "b035d372e06cd372f03bd372f039d3723040d372700cd472" to virtual address "0x765911EC" (part of module "ADVAPI32.DLL") ".exe" wrote bytes "d04ff376f0c2dd7690c6e67600cbdd76f0f3e57640dde57660efe576102dde7680a6dd7620bee4767042e676a0bee476c0ffdd7640bfe476e058e676" to virtual address "0x76B615B0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "e02a1274f0291274702a1274" to virtual address "0x7384700C" (part of module "RSAENH.DLL") ".exe" wrote bytes "c0da1374c0db1374d07a1474" to virtual address "0x765910C0" (part of module "ADVAPI32.DLL") ".exe" wrote bytes "c002fd76" to virtual address "0x72D540B8" (part of module "NTMARTA.DLL") ".exe" wrote bytes "f0bbc976904bc87600fac77660bfc97610a2c976b08fc9764002c87640fcc776" to virtual address "0x726D6000" (part of module "BCRYPT.DLL") "attrib.exe" wrote bytes "a01a7e73601a7e73801a7e73e01a7e73" to virtual address "0x73813000" (part of module "ULIB.DLL") "taskdl.exe" wrote bytes "a0924901b0924901b017010080f00600c0020100b0f0060060b20600e0914901f0914901" to virtual address "0x7637AC94" (part of module "USER32.DLL") "taskdl.exe" wrote bytes "309f0e76f0661176702a0d7620a40e7670230d76003b0e7610600e76b05b0e7600b00e76805b0e76d0810e76d00d0c76" to virtual address "0x76BEE018" (part of module "GDI32.DLL") "taskdl.exe" wrote bytes "1032737780ec7777208a747700000000" to virtual address "0x77273000" (part of module "WIN32U.DLL") "cscript.exe" wrote bytes "40f6df76b007e476409edf76d0d8df7670f0e676b0f0df768004e076106ee07670b7e076b0ffe076e0acef7600bae6760041e676608ade760091de76603ce47660f8e576606ee0765007e37650b8e37640f8e6769041e67650dae676" to virtual address "0x7711D010" (part of module "SHCORE.DLL") "cscript.exe" wrote bytes "c0690d77a02f0d7730690d77" to virtual address "0x76B616F4" (part of module "WINDOWS.STORAGE.DLL") "cscript.exe" wrote bytes "70eb317600ec317640ec3176" to virtual address "0x76F801FC" (part of module "COMBASE.DLL") "cscript.exe" wrote bytes "70da3076b0a83176" to virtual address "0x775CE2D8" (part of module "KERNELBASE.DLL") "cscript.exe" wrote bytes "801f0d76a05a0e76e0940e76d07b0e76b01e0d76d01d0d76f0e31076703f0e7650fa0b76a0800c76" to virtual address "0x76BEE138" (part of module "GDI32.DLL") "cscript.exe" wrote bytes "d04ff376f0c2dd7690c6e67600cbdd76f0f3e57640dde57660efe576102dde7680a6dd7620bee4767042e676a0bee476c0ffdd7640bfe476e058e676" to virtual address "0x76B615B0" (part of module "WINDOWS.STORAGE.DLL") "cscript.exe" wrote bytes "5007e3769041e676106ee076606ee07660f8e576a0f9e576b0f0df76608ade76b0ffe076603ce476f0efe57670f0e5760041e6768004e076b007e476b0ffe3760091de76" to virtual address "0x734E2048" "cscript.exe" wrote bytes "30666477100c647770236477" to virtual address "0x76B615F0" (part of module "WINDOWS.STORAGE.DLL") "cscript.exe" wrote bytes "e02a1274f0291274702a1274" to virtual address "0x7384700C" (part of module "RSAENH.DLL") "cscript.exe" wrote bytes "10f2317600b93076f0917977109d317690923176c0b4317650883176d067317640b23176209c3176108c3176a0a43176507c317650a93176c0b33176805d3176c0e6317690753176c0ee3176a0c4317600c0317610d2307660aa3176" to virtual address "0x76F80228" (part of module "COMBASE.DLL") "cscript.exe" wrote bytes "0041e676003de676608ade76b0ffe0760091de76b007e476e0b6e07650b6e076b0f0df760092e67650bce076b0ffe3769041e67670b7e07610c7e6768004e076" to virtual address "0x77089058" "cscript.exe" wrote bytes "705bbd76906abd764037bd76f06bbd767068bd76d06abd76e045bd76e03abd76e068bd76b069bd76b06bbd76b055bd76506abd76b071bd76406bbd763069bd76806dbd76707abd769037bd76" to virtual address "0x7453D000" (part of module "IMM32.DLL") "cscript.exe" wrote bytes "e02df27650a4e676" to virtual address "0x7708909C" "cscript.exe" wrote bytes "408a0c77306c0d7770c60d77f0410d7700bd0d7710300d77a0cc0d7720410d7720870d7790840c7760a30d7790a20d77d0f40d77e0030e77a0e10b77402c0e7770d80b7770c70d7750511177c0910d7750890d7770350b7720ef0d77" to virtual address "0x764C0118" (part of module "SHLWAPI.DLL")62:T1d08,".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\CertificateRevocation\6498.2022.11.1\~SDDE6E.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\~SDDE7F.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\attachments\~SDDE80.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\reports\~SDDE81.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\~SDDE82.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\~SDDEC4.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\~SDDF09.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\~SDDF1A.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\~SDE341.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\~SDE342.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Collections\~SDE4AE.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\commerce_subscription_db\~SDE4BE.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Continuous Migration\~SDE4BF.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Continuous Migration\Logs\~SDE4C0.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\~SDE4E2.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\~SDE4F3.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\~SDE4F4.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\~SDE508.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\~SDE518.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\AvailabilityDB\~SDE519.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Feature Engagement Tracker\EventDB\~SDE51A.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\~SDE51B.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\~SDE52C.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\~SDE52D.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\~SDE53E.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\~SDE564.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\~SDE565.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Nurturing\~SDE566.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\~SDE576.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\optimization_guide_model_metadata_store\~SDE577.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\~SDE578.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Safe Browsing Network\~SDE589.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Segmentation Platform\~SDE58A.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB\~SDE58B.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB\~SDE59C.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB\~SDE59D.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\~SDE59E.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\~SDE59F.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\~SDE5AF.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\34d60ed8-3cab-434b-a0f5-c60d2abde5e6\~SDE5B0.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\34d60ed8-3cab-434b-a0f5-c60d2abde5e6\index-dir\~SDE5C1.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\597ece8a-69a9-4927-a875-65926b9dfe37\~SDE5C2.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\597ece8a-69a9-4927-a875-65926b9dfe37\index-dir\~SDE5C3.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6b33b2c2-3c5e-4379-86e5-45ef944b6b16\~SDE5D4.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6b33b2c2-3c5e-4379-86e5-45ef944b6b16\index-dir\~SDE5D5.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98b7cf66-0885-4491-845a-fb7b97c1aa86\~SDE5D6.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\98b7cf66-0885-4491-845a-fb7b97c1aa86\index-dir\~SDE7BB.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9e7860ba-38ed-461a-a448-5d9b61a95709\~SDE7BC.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9e7860ba-38ed-461a-a448-5d9b61a95709\index-dir\~SDE7CD.tmp" ".exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af3209ba-886c-45f7-b5d7-22af4c8da3b3\~SDE7CE.tmp"63:T45e,Spawned process ".exe" (UID: 00000000-00006324) Spawned process "attrib.exe" with commandline "attrib +h ." (UID: 00000000-00004016) Spawned process "icacls.exe" with commandline "icacls . /grant Everyone:F /T /C /Q" (UID: 00000000-00007184) Spawned process "taskdl.exe" (UID: 00000000-00006632) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c 123901688625357.bat" (UID: 00000000-00006220) Spawned process "@WanaDecryptor@.exe" with commandline "fi" (UID: 00000000-00002828) Spawned process "cscript.exe" with commandline "//nologo m.vbs" (UID: 00000000-00006960) Spawned process "attrib.exe" with commandline "attrib +h +s Z:\\$RECYCLE" (UID: 00000000-00007760) Spawned process "taskdl.exe" (UID: 00000000-00008024) Spawned process "taskdl.exe" (UID: 00000000-00005528) Spawned process "taskdl.exe" (UID: 00000000-00000060) Spawned process "taskdl.exe" (UID: 00000000-00007312) Spawned process "WerFault.exe" with commandline "-u -p 6324 -s 836" (UID: 00000000-00000240) Spawned process "WerFault.exe" with commandline "-u -p 6324 -s 828" (UID: 00000000-00003852)64:T932,"@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")65:T53d,"@WanaDecryptor@.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "@WanaDecryptor@.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790611751809,"unified_at":"2026-09-28T16:09:11.809Z","metadata":{"hashes":{"sha256":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","sha1":"91956921fdd1b3389834596f46d5d9c152fd2a0b","md5":"f9cee5e75b7f1298aece9145ea80a1d2","sha512":"4d3b0d1588c47cffd72a92876b05e3203a6d1df90ce6b13bacf636f104234e1e1fa9313df683cb345af2d89bb89684a6e9b0b07d2d8dad4172abb67c42a13e05","ssdeep":"49152:nQqMSPbcBVQeBvgyd7+KnT2becwT6DGMIBHuLZyLUcRhRt/IbmwW6LCY:QqPoBhGywKSbevWSdOLZSPebdWOCY","ssdeep_chunks":["49152:nQqMSPb","49152:QqMSPbc","49152:qMSPbcB","49152:MSPbcBV","49152:SPbcBVQ","49152:PbcBVQe","49152:bcBVQeB","49152:cBVQeBv","49152:BVQeBvg","49152:VQeBvgy","49152:QeBvgyd","49152:eBvgyd7","49152:Bvgyd7+","49152:vgyd7+K","49152:gyd7+Kn","49152:yd7+KnT","49152:d7+KnT2","49152:7+KnT2b","49152:+KnT2be","49152:KnT2bec","49152:nT2becw","49152:T2becwT","49152:2becwT6","49152:becwT6D","49152:ecwT6DG","49152:cwT6DGM","49152:wT6DGMI","49152:T6DGMIB","49152:6DGMIBH","49152:DGMIBHu","49152:GMIBHuL","49152:MIBHuLZ","49152:IBHuLZy","49152:BHuLZyL","49152:HuLZyLU","49152:uLZyLUc","49152:LZyLUcR","49152:ZyLUcRh","49152:yLUcRhR","49152:LUcRhRt","49152:UcRhRt/","49152:cRhRt/I","49152:RhRt/Ib","49152:hRt/Ibm","49152:Rt/Ibmw","49152:t/IbmwW","49152:/IbmwW6","49152:IbmwW6L","49152:bmwW6LC","49152:mwW6LCY","98304:nQqMSPb","98304:QqMSPbc","98304:qMSPbcB","98304:MSPbcBV","98304:SPbcBVQ","98304:PbcBVQe","98304:bcBVQeB","98304:cBVQeBv","98304:BVQeBvg","98304:VQeBvgy","98304:QeBvgyd","98304:eBvgyd7","98304:Bvgyd7+","98304:vgyd7+K","98304:gyd7+Kn","98304:yd7+KnT","98304:d7+KnT2","98304:7+KnT2b","98304:+KnT2be","98304:KnT2bec","98304:nT2becw","98304:T2becwT","98304:2becwT6","98304:becwT6D","98304:ecwT6DG","98304:cwT6DGM","98304:wT6DGMI","98304:T6DGMIB","98304:6DGMIBH","98304:DGMIBHu","98304:GMIBHuL","98304:MIBHuLZ","98304:IBHuLZy","98304:BHuLZyL","98304:HuLZyLU","98304:uLZyLUc","98304:LZyLUcR","98304:ZyLUcRh","98304:yLUcRhR","98304:LUcRhRt","98304:UcRhRt/","98304:cRhRt/I","98304:RhRt/Ib","98304:hRt/Ibm","98304:Rt/Ibmw","98304:t/IbmwW","98304:/IbmwW6","98304:IbmwW6L","98304:bmwW6LC","98304:mwW6LCY","49152:QqPoBhG","49152:qPoBhGy","49152:PoBhGyw","49152:oBhGywK","49152:BhGywKS","49152:hGywKSb","49152:GywKSbe","49152:ywKSbev","49152:wKSbevW","49152:KSbevWS","49152:SbevWSd","49152:bevWSdO","49152:evWSdOL","49152:vWSdOLZ","49152:WSdOLZS","49152:SdOLZSP","49152:dOLZSPe","49152:OLZSPeb","49152:LZSPebd","49152:ZSPebdW","49152:SPebdWO","49152:PebdWOC","49152:ebdWOCY"],"imphash":"68f013d7437aa653a8a98a05807afeb1"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3514368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1616507405000,"last_seen":1689211056000,"last_multi_scan":1689211056000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","crypt","cve-2017-0147","downloader","ransomware","wanacrypt0r","wanaransomware","wannacry","wannacrypt","wcry"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":199,"suspicious_count":26,"malicious_count":14,"total":239},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.toNn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.WannaCryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Scatter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.WannaCryptor.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Wannacryptor-9940180-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.WannaCrypt.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.WannaCryptor.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.WannaCryptor.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Wannacry.j","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050d7171 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Wanna.zbu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-WannaCry!F9CEE5E75B7F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.eorfmq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EMG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.WannaCry.Zen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_WCRY.J","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_WCRY.J","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.ZTSA-8671","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.SRO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.WannaCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.WannaCry.Win32.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.WannaCryptor","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"},{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Found anti-virus related strings names"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a computer-based training (CBT) hook"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"},{"type":"suspicious","value":"Tries to access a Windows Vault/Credential locations"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to collect sensitive information via text files"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Tries to access browsers/wallets sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"},{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"},{"type":"informative","value":"Attempts to read Outlook-related files (file access)"},{"type":"informative","value":"Attempts to write Outlook-related files (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Persistence","technique":"Office Template Macros","attack_id":"T1137.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1137/001","identifiers":[{"type":"informative","value":"Contains reference to MS Word template folder"}],"sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceA\" (UID: 00000000-00006324)\n \"@WanaDecryptor@.exe\" called \"FindResourceA\" with parameter \"3585\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"FindResourceA\" with parameter \"128\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"FindResourceA\" with parameter \"102\" - (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource with parameter \" (UID: 00000000-00006324)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002828.00000000.78184.02C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"SettingsCache.txt.WNCRYT\")\n file/memory contains long string with (Indicator: \"RC2\"; File: \"appssynonyms.txt.WNCRYT\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$28","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"CryptoAPI Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.995508481803877","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"@WanaDecryptor@.exe\" called \"GetWindowTextA\" with parameter \"About bitcoin\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"GetWindowTextA\" with parameter \"How to buy bitcoins?\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"GetWindowTextA\" with parameter \"Contact Us\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"GetWindowTextA\" with parameter \"QR Code\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"GetWindowTextA\" with parameter \"1/1/2017 00:00:00\" - (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"GetWindowTextA\" (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006324)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006220)\n \"@WanaDecryptor@.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexA\" with parameter \"Global\\MsWinZonesCacheCounterMutexW\" - (UID: 00000000-00006324)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"@WanaDecryptor@.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006960)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006960)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002828-413-170-0040BAF0\n GetTickCount@KERNEL32.dll at 3884-305-0040BAF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002828-413-336-00403CB0\n FindFirstFileA@KERNEL32.DLL at 00000000-00002828-413-231-004080C0\n FindFirstFileW@KERNEL32.DLL at 00000000-00002828-413-346-004026B0\n FindFirstFileA@KERNEL32.dll at 3884-551-00403CB0\n FindFirstFileW@KERNEL32.dll at 3884-561-004026B0\n FindFirstFileA@KERNEL32.dll at 3884-395-004080C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00002828-413-345-00403A20\n GetLogicalDrives@KERNEL32.dll at 3884-560-00403A20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00002828-413-248-0040734A\n GetTimeZoneInformation@KERNEL32.dll at 3884-421-0040734A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002828-413-262-00406C20\n GetLocaleInfoA@KERNEL32.dll at 3884-443-00406C20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00002828-413-345-00403A20\n GetDiskFreeSpaceExW@KERNEL32.dll at 3884-560-00403A20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"SET ow = WScript.CreateObject(\"WScript.Shell\")SET om = ow.CreateShortcut(\"C:\\@WanaDecryptor@.exe.lnk\")om.TargetPath = \"C:\\@WanaDecryptor@.exe\"om.Save\" (Indicator: \"set \"; File: \"m.vbs\")\n Found string \"SET ow = WScript.CreateObject(\"WScript.Shell\")\" (Indicator: \"set \"; File: \"m.vbs\")\n Found string \"SET om = ow.CreateShortcut(\"C:\\@WanaDecryptor@.exe.lnk\")\" (Indicator: \"set \"; File: \"m.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00006324.00000000.77862.0040F000.00000004.mdmp, 00000000-00006324.00000001.79781.0040F000.00000004.mdmp, 00000000-00006324.00000002.81701.0040F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@KERNEL32.DLL at 00000000-00002828-413-262-00406C20\n GetUserDefaultLangID@KERNEL32.dll at 3884-443-00406C20","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"10769456934,1836,3024,,RtlGetVersion,NTDLL.dll,\"00:20:16.546\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00006324-58962-11-004021E9\n GetProcessHeap@KERNEL32.DLL at 00000000-00006324-58962-12-004029CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"@WanaDecryptor@.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$30","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter Z:\\$RECYCLE (UID: 00000000-00006324)\n \"@WanaDecryptor@.exe\" called \"CreateDirectoryA\" with parameter TaskData (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"attrib +h .\" - (UID: 00000000-00006324)\n \".exe\" called \"CreateProcessA\" with parameter \"icacls . /grant Everyone:F /T /C /Q\" - (UID: 00000000-00006324)\n \".exe\" called \"CreateProcessA\" with parameter \"taskdl.exe\" - (UID: 00000000-00006324)\n \".exe\" called \"CreateProcessA\" with parameter \"123901688625357.bat\" - (UID: 00000000-00006324)\n \".exe\" called \"CreateProcessA\" with parameter \"@WanaDecryptor@.exe fi\" - (UID: 00000000-00006324)\n \".exe\" called \"CreateProcessA\" with parameter \"attrib +h +s Z:\\$RECYCLE\" - (UID: 00000000-00006324)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"cscript.exe //nologo m.vbs\" - (UID: 00000000-00006220)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00006324-58962-102-00401EFF\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006324-58962-39-00401064\n SetTimer at 00000000-00002828-413-381-004011B3\n WaitForSingleObject@KERNEL32.DLL at 00000000-00002828-413-271-00401A90\n Sleep@KERNEL32.DLL at 00000000-00002828-413-170-0040BAF0\n Sleep@KERNEL32.DLL at 00000000-00002828-413-149-0040D300\n WaitForSingleObject@KERNEL32.DLL at 00000000-00002828-413-371-00401760\n Sleep@KERNEL32.DLL at 00000000-00002828-413-270-004065D1\n Sleep@KERNEL32.DLL at 00000000-00002828-413-147-0040D4C0\n SetTimer at 3884-600-004011B3\n Sleep@KERNEL32.dll at 3884-305-0040BAF0\n Sleep@KERNEL32.dll at 3884-278-0040D4C0\n WaitForSingleObject@KERNEL32.dll at 3884-460-00401A90\n Sleep@KERNEL32.dll at 3884-459-004065D1\n WaitForSingleObject@KERNEL32.dll at 3884-590-00401760\n Sleep@KERNEL32.dll at 3884-280-0040D300","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: @WanaDecryptor@.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: taskse.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00006324-58962-37-0040170A\n LoadLibraryA@KERNEL32.DLL at 00000000-00006324-58962-38-00401A45\n LoadLibraryA@KERNEL32.DLL at 00000000-00002828-413-277-00402C40\n LoadLibraryA@KERNEL32.DLL at 00000000-00002828-413-278-00404B70\n LoadLibraryA@KERNEL32.dll at 3884-466-00402C40\n LoadLibraryA@KERNEL32.dll at 3884-467-00404B70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"MsWinZonesCacheCounterMutexA\"\n \"Local\\SM0:6324:168:WilStaging_02\"\n \"SM0:6324:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:2828:168:WilStaging_02\"\n \"SM0:2828:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c 123901688625357.bat\" (UID: 00000000-00006220)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"@WanaDecryptor@.exe\" failed to load missing module \"phoneinfo.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\".ost\" (Indicator: \".ost\") in Source: 00000000-00006324.00000000.77862.02E20000.00000004.mdmp\n 00000000-00006324.00000000.77862.1000C000.00000004.mdmp\n 00000000-00006324.00000001.79781.02E20000.00000004.mdmp\n 00000000-00006324.00000001.79781.1000C000.00000004.mdmp\n 00000000-00006324.00000002.81701.02E20000.00000004.mdmp\n 00000000-00006324.00000002.81701.1000C000.00000004.mdmp\n \".pst\" (Indicator: \".pst\") in Source: 00000000-00006324.00000000.77862.02E20000.00000004.mdmp\n 00000000-00006324.00000000.77862.1000C000.00000004.mdmp\n 00000000-00006324.00000001.79781.02E20000.00000004.mdmp\n 00000000-00006324.00000001.79781.1000C000.00000004.mdmp\n 00000000-00006324.00000002.81701.02E20000.00000004.mdmp\n 00000000-00006324.00000002.81701.1000C000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \".pst\") in Source: 00000000-00006324.00000001.79781.049D0000.00000004.mdmp\n 00000000-00006324.00000002.81701.049D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00002828-00000C7B-9288730773\")\n Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CL\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00002828-00000C7C-9293476141\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"//nologo m.vbs\" (UID: 00000000-00006960)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 73810000\n \"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 722E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73810000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 726C0000\n \"attrib.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"taskdl.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 726C0000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C70000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 726C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000\n \"attrib.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000\n \"icacls.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000\n \"taskdl.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000\n \"@WanaDecryptor@.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77280000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"cscript.exe\" called \"WScript.CreateObject\" with result: \"IDispatch\" ...\n \"cscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"cscript.exe\" called \"WScript.Shell.1.Unnamed\" ... \n \"cscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\@WanaDecryptor@.exe.lnk\" ...\n \"cscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3c","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"cscript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\\INPROCSERVER32\")\n \"cscript.exe\" touched \"Windows Script Host Shell Object\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\\INPROCSERVER32\")\n \"cscript.exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\\INPROCSERVER32\")\n \"cscript.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\" has an executable section named \".text\"\n \"@WanaDecryptor@.exe\" has an executable section named \".text\"\n \"taskse.exe\" has an executable section named \".text\"\n \"taskdl.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\" has an writable section named \".data\"\n \"@WanaDecryptor@.exe\" has an writable section named \".data\"\n \"taskse.exe\" has an writable section named \".data\"\n \"taskdl.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x34a000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x349fa0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\attrib.exe\" [Source: 00000000-00006324-00000BC0-67868649]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\icacls.exe\" [Source: 00000000-00006324-00000BC0-67906980]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00006324-00000BC0-71567489]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cscript.exe\" [Source: 00000000-00006220-00000BC0-77571249]\n Observed system executable string:\"%WINDIR%\\system32\\cscript.exe\" [Source: 00000000-00006220-00000C40-12181814985]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c 123901688625357.bat\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"attrib.exe\" (UID: 00000000-00004016) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"attrib.exe\" (UID: 00000000-00004016) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cscript.exe\" (UID: 00000000-00006960) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"attrib.exe\" (UID: 00000000-00007760) was launched with missing environment variables: \"PROMPT\"\n Process \"WerFault.exe\" (UID: 00000000-00000240) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"WerFault.exe\" (UID: 00000000-00000240) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\\\system32\\\\cmd.exe /c 123901688625357.bat\" on 2023-7-5.23:36:07.828","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"@WanaDecryptor@.exe\" searching for window \"Wana Decrypt0r 2.0\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"@WanaDecryptor@.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 6964","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$41","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 553314)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"@WanaDecryptor@.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"taskse.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"taskdl.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00002828-413-169-0040BED0\n GetUserNameA@ADVAPI32.dll at 3884-304-0040BED0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"@WanaDecryptor@.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"cscript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\attrib.exe\" (UID: 6324)\n \".exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\icacls.exe\" (UID: 6324)\n \".exe\" queries basic process information of the \"C:\\taskdl.exe\" (UID: 6324)\n \".exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cmd.exe\" (UID: 6324)\n \".exe\" queries basic process information of the \"C:\\@WanaDecryptor@.exe\" (UID: 6324)\n \".exe\" queries basic process information of the \"C:\\149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.exe\" (UID: 6324)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cscript.exe\" (UID: 6220)\n \"cscript.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\cscript.exe\" (UID: 6960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"@WanaDecryptor@.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\c.wnry\"\n \".exe\" reads file \"c:\\t.wnry\"\n \".exe\" reads file \"c:\\00000000.pky\"\n \".exe\" reads file \"c:\\u.wnry\"\n \".exe\" reads file \"c:\\users\\%osuser%\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2\"\n \".exe\" reads file \"c:\\@please_read_me@.txt\"\n \".exe\" reads file \"c:\\$windows.~bt\\sources\\hwcompat.txt\"\n \".exe\" reads file \"c:\\@wanadecryptor@.exe\"\n \".exe\" reads file \"c:\\programdata\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt\"\n \".exe\" reads file \"c:\\@wanadecryptor@.exe.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: The input sample possibly contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to query volume size\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \".exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\Temp\\VxOle32.dll\"\n \".exe\" trying to touch file \"C:\\windows\\temp\\VxOle32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\b.wnry\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"@WanaDecryptor@.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /torbrowser/6.5.1/tor-win32-0.2.9.10.zip\" - (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"@WanaDecryptor@.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (UID: 00000000-00002828)\n \"@WanaDecryptor@.exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CL\" (UID: 00000000-00002828)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"12t9YDPgwueZ9NyMgw519p7AA8isjr6SMwgx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip\" (Indicator: \".onion\") in Source: c.wnry\n \"gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;\" (Indicator: \".onion\") in Source: 00000000-00002828.00000000.78184.008E5000.00000004.mdmp\n \"gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;\" (Indicator: \".onion\") in Source: 00000000-00006324.00000000.77862.1000C000.00000004.mdmp\n 00000000-00006324.00000001.79781.1000C000.00000004.mdmp\n 00000000-00006324.00000002.81701.1000C000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /torbrowser/6.5.1/tor-win32-0.2.9.10.zip HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002828.00000000.78184.02C20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://dist.torproject.org\"\n Found HTTPS url \"https://en.wikipedia.org\"\n Found HTTPS url \"https://www.google.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"@WanaDecryptor@.exe\"\n YARA signature for AES encryption matched on file \"u.wnry\"\n YARA signature for AES encryption matched on process \"00000000-00006324\"\n YARA signature for AES encryption matched on process \"00000000-00002828\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"taskse.exe.539085069\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; File: \"taskse.exe.539085069\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"taskse.exe.539085069\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006324)\n \"attrib.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"taskdl.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\".exe\" called \"GetComputerNameW\" (UID: 00000000-00006324)\n \"cscript.exe\" called \"GetComputerNameW\" (UID: 00000000-00006960)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\".exe\" called \"GetUserNameW\" (UID: 00000000-00006324)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; File: \"taskse.exe.539085069\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"10769456934,1836,3024,,RtlGetVersion,NTDLL.dll,\"00:20:16.546\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006324-00000C27-28780332942\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\@Please_Read_Me@.txt\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006324-00000C36-29014687413\")\n Found string \"%USERPROFILE%\\Documents\\Outlook Files\\@WanaDecryptor@.exe.lnk\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006324-00000C36-29016681149\")\n Found string \"C:\\Users\\HAPUBWS\\Documents\\Outlook Files\\Outlook.pst\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006324.00000001.79781.049D0000.00000004.mdmp, 00000000-00006324.00000002.81701.049D0000.00000004.mdmp\")\n Found string \"C:\\Users\\Dske9oE\\AppData\\Local\\Microsoft\\Outlook\" (Indicator: \"\\appdata\\local\\microsoft\\outlook\"; Source: \"00000000-00006324.00000001.79781.04AE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$52","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%USERPROFILE%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006324-00000C27-44883342979\")\n \"%USERPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00006324-00000C27-44897607586\")\n \"C:\\Users\\Dske9oE\\AppData\\Local\\Microsoft\\Credentials\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00006324.00000001.79781.04AE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$53","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; File: \"taskse.exe.539085069\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"taskse.exe.539085069\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del m.vbs\" (Indicator: \"del \") in Source: 123901688625357.bat\n Observed string: \"del /a %0\" (Indicator: \"del \") in Source: 123901688625357.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; File: \"taskse.exe.539085069\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"taskse.exe.539085069\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; File: \"taskse.exe.539085069\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002828.00000000.78184.00415000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006324.00000000.77862.00408000.00000002.mdmp, 00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.10007000.00000002.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.00408000.00000002.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.10007000.00000002.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.00408000.00000002.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.10007000.00000002.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"@WanaDecryptor@.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"\"rescued\" (Indicator: \"rescue\")\n \"cleaner\" (Indicator: \"cleaner\")\n \"cleaners\" (Indicator: \"cleaner\")\n \"snort\" (Indicator: \"snort\")\n \"snorting\" (Indicator: \"snort\")\n \"snorted\" (Indicator: \"snort\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"Allocates and initializes a security identifier (SID) with up to eight subauthorities\" [Source: @WanaDecryptor@.exe]\n Observed import api \"CheckTokenMembership\" which can \"Determines whether a specified security identifier (SID) is enabled in an access token\" [Source: @WanaDecryptor@.exe]\n Observed import api \"FreeSid\" which can \"Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: @WanaDecryptor@.exe]\n Observed import api \"InitializeSid\" which can \"Initializes a security identifier (SID)\" [Source: @WanaDecryptor@.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$59","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"@WanaDecryptor@.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskse.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"taskdl.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .data\n .data with unusual entropies 7.99988042995\n 0.79975850341\n 0.105612474489","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\".exe queries ProcessDebugPort (UID: 6324)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"USRCLA~1.REGUsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")\n \"SRCLA~2.REGUsrClass.dat{d2747a47-2058-11e8-b41f-0800274b5076}.TMContainer00000000000000000002.regtrans-msloap\" (Indicator: \"080027\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"64/70 Antivirus vendors marked sample as malicious (91% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00006324-58962-42-00401DAB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"@WanaDecryptor@.exe\" reads file \"C:\\Windows\\win.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"cscript.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5b","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5c","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"@WanaDecryptor@.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00002828-413-237-00407E80\n SystemParametersInfoA@USER32.DLL at 00000000-00002828-413-291-004085C0\n SystemParametersInfoA@USER32.dll at 3884-487-004085C0\n SystemParametersInfoW@USER32.dll at 3884-402-00407E80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions in file \"00000000-00006324.00000000.77862.02E20000.00000004.mdmp, 00000000-00006324.00000000.77862.1000C000.00000004.mdmp, 00000000-00006324.00000001.79781.02E20000.00000004.mdmp, 00000000-00006324.00000001.79781.1000C000.00000004.mdmp, 00000000-00006324.00000002.81701.02E20000.00000004.mdmp, 00000000-00006324.00000002.81701.1000C000.00000004.mdmp\" : .lay6\n .sqlite3\n .sqlitedb\n .accdb\n .java\n .class\n .mpeg\n .djvu\n .tiff\n .jpeg\n .backup\n .vmdk\n .sldm\n .sldx\n .onetoc2\n .potm\n .potx\n .ppam\n .ppsx\n .ppsm\n .pptm\n .pptx\n .xltm\n .xltx\n .xlsb\n .xlsm\n .xlsx\n .dotx\n .dotm\n .docm\n .docb\n .docx\n .der\n .pfx\n .key\n .crt\n .csr\n .p12\n .pem\n .odt\n .ott\n .sxw\n .stw\n .uot\n .3ds\n .max\n .3dm\n .ods\n .ots\n .sxc\n .stc\n .dif\n .slk\n .wb2\n .odp\n .otp\n .sxd\n .std\n .uop\n .odg\n .otg\n .sxm\n .mml\n .lay\n .lay6","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1491.001","relevance":5,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"$5e","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00002828-413-360-004035A0\n OpenClipboard@USER32.dll at 3884-576-004035A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00006324-58962-2-00401FE7\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00002828-413-279-004064D0\n GetModuleFileNameA@KERNEL32.dll at 3884-468-004064D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers/wallets sensitive information (file access)","description":"\".exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Local Storage\\leveldb\\~SDE564.tmp\"\n \".exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Storage\\ext\\ihmafllikibpmigkcoadcmckbfhibefp\\def\\Local Storage\\leveldb\\~SDE871.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to collect sensitive information via text files","description":"\"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.exe\" trying to write data to a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\ZxcvbnData\\3.0.0.0\\passwords.txt.WNCRYT\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-133","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$5f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$60","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"@WanaDecryptor@.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n CreateServiceA\n RegCreateKeyW\n StartServiceA\n LoadLibraryA\n GetFileAttributesA\n CopyFileA\n VirtualProtect\n GetFileAttributesW\n GetModuleFileNameA\n GetStartupInfoA\n GetFileSize\n LockResource\n CreateDirectoryA\n CreateDirectoryW\n GetProcAddress\n GetComputerNameW\n GetFileSizeEx\n GetModuleHandleA\n GetTempPathW\n TerminateProcess\n CreateProcessA\n WriteFile\n Sleep\n CreateFileA\n FindResourceA\n VirtualAlloc\n GetUserNameA\n CopyFileW\n GetDriveTypeW\n FindFirstFileW\n FindNextFileW\n DeleteFileA\n GetLogicalDrives\n CreateThread\n FindFirstFileA\n GetTempFileNameA\n GetComputerNameA\n FindNextFileA\n GetTickCount\n ShellExecuteExA\n ShellExecuteA\n FindWindowW\n recv\n socket\n bind\n send\n WSAStartup\n connect\n closesocket\n URLDownloadToFileA\n DeleteFileW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$61","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +h .\" (UID: 00000000-00004016)\n Process \"attrib.exe\" with commandline \"attrib +h +s Z:\\\\$RECYCLE\" (UID: 00000000-00007760)","origin":"Monitored Target","mitre_attack_id":"T1564.001","relevance":3,"id":"target-166","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"64/70 Antivirus vendors marked sample as malicious (91% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"65/71 Antivirus vendors marked dropped file \"@WanaDecryptor@.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 91% detection rate)\n 63/71 Antivirus vendors marked dropped file \"taskse.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 88% detection rate)\n 62/71 Antivirus vendors marked dropped file \"taskdl.exe\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 87% detection rate)\n 22/57 Antivirus vendors marked dropped file \"123901688625357.bat\" as malicious (classified as \"BAT_WCRY.BA\" with 38% detection rate)\n 20/56 Antivirus vendors marked dropped file \"m.vbs\" as malicious (classified as \"Trojan.Generic\" with 35% detection rate)\n 65/71 Antivirus vendors marked dropped file \"u.wnry\" as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 91% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"62/71 Antivirus vendors marked spawned process \"taskdl.exe\" (PID: 6632) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 87% detection rate)\n 65/71 Antivirus vendors marked spawned process \"@WanaDecryptor@.exe\" (PID: 2828) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 91% detection rate)\n 62/71 Antivirus vendors marked spawned process \"taskdl.exe\" (PID: 8024) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 87% detection rate)\n 62/71 Antivirus vendors marked spawned process \"taskdl.exe\" (PID: 5528) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 87% detection rate)\n 62/71 Antivirus vendors marked spawned process \"taskdl.exe\" (PID: 60) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 87% detection rate)\n 62/71 Antivirus vendors marked spawned process \"taskdl.exe\" (PID: 7312) as malicious (classified as \"Trojan.Ransom.WannaCryptor\" with 87% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"@WanaDecryptor@.exe\" sets a callback procedure (72522000) using filter \"WH_CBT\" for process ID: b0c","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\attrib.exe\" (Handle: 356)\n \".exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\icacls.exe\" (Handle: 356)\n \".exe\" wrote 4 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 644)\n \".exe\" wrote 4 bytes to a remote process \"C:\\@WanaDecryptor@.exe\" (Handle: 700)\n \".exe\" wrote 4 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 764)\n \".exe\" wrote 4 bytes to a remote process \"C:\\taskdl.exe\" (Handle: 636)\n \"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\cscript.exe\" (Handle: 404)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was made using TLSv1.1 [tls.handshake.version: 0x00000302]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"WannaDecryptor\" classified file \"sample.bin\" as \"ransomware,wcry,wannacry,wanacrypt0r\"\n YARA signature \"WanaCrypt0r\" classified process \"00000000-00006324\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Author: Leo Fernandes - iDefense)\n YARA signature \"WannCry_BAT\" classified process \"00000000-00006324\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)\n YARA signature \"WannaDecryptor\" classified process \"00000000-00006324\" as \"ransomware,wcry,wannacry,wanacrypt0r\"\n YARA signature \"WannCry_m_vbs\" classified file \"123901688625357.bat\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)\n YARA signature \"WannCry_BAT\" classified file \"123901688625357.bat\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)\n YARA signature \"WannCry_m_vbs\" classified file \"m.vbs\" as \"ransomware,wcry,wannacry,wanacrypt0r\" (Reference: https://goo.gl/HG2j5T, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"@WanaDecryptor@.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\")\n \"@WanaDecryptor@.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\IDENTITYCRL\"; Key: \"LOGINURL\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$62","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00000000-00007184)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$63","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"u.wnry.121700361\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"Database1.accdb.WNCRYT\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00008068-00000C15-79736051","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cscript.exe\" queries volume information of \"C:\\\" at 00000000-00008068-00000C15-79736051","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$64","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$65","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Attempts to read Outlook-related files (file access)","description":"\".exe\" tries to access a file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \".exe\" tries to access a file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-157","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Attempts to write Outlook-related files (file access)","description":"\".exe\" writes file \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\"\n \"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.exe\" writes file \"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst\"","origin":"API Call","mitre_attack_id":"T1114.001","relevance":3,"id":"api-158","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"204.8.99.146:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"dist.torproject.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"@WanaDecryptor@.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00006044-00000C25-77202901\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /torbrowser/6.5.1/tor-win32-0.2.9.10.zip HTTP/1.1Accept: */*\n Accept-Encoding: gzip\n deflate\n User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\n Host: dist.torproject.org\n Connection: Keep-Alive","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"204.8.99.146\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to MS Word template folder","description":"file/memory contains long string with (Indicator: \"\\roaming\\microsoft\\templates\"; File: \"f.wnry\")","origin":"File/Memory","mitre_attack_id":"T1137.001","relevance":1,"id":"string-440","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 204.8.99.146 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"icacls.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"Everyone\"\n \"Sid\": \"0\"\n \"cbSid\": \"0c000000\"\n \"cchReferencedDomainName\": \"01000000\"\n \"peUse\": \"00000000\"}\n \"icacls.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"Everyone\"\n \"Sid\": \"12979544\"\n \"cbSid\": \"0c000000\"\n \"cchReferencedDomainName\": \"00000000\"\n \"peUse\": \"05000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access a Windows Vault/Credential locations","description":"\".exe\" trying to access a file \"C:\\Users\\All Users\\MICROSOFT\\VAULT\\~SDBA80.TMP\"\n \".exe\" trying to access a file \"C:\\Users\\All Users\\MICROSOFT\\VAULT\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\~SDBAA0.TMP\"\n \".exe\" trying to access a file \"C:\\ProgramData\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\~SDBAA0.tmp\"\n \".exe\" trying to access a file \"%USERPROFILE%\\MICROSOFT\\VAULT\\~SDBA80.TMP\"\n \".exe\" trying to access a file \"%ALLUSERSPROFILE%\\Microsoft\\Vault\\~SDBA80.tmp\"\n \".exe\" trying to access a file \"%USERPROFILE%\\MICROSOFT\\VAULT\\AC658CB4-9126-49BD-B877-31EEDAB3F204\"\n \".exe\" trying to access a file \"%USERPROFILE%\\MICROSOFT\\VAULT\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\~SDBAA0.TMP\"\n \".exe\" trying to access a file \"%ALLUSERSPROFILE%\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\~SDBAA0.tmp\"","origin":"API Call","mitre_attack_id":"T1555.004","relevance":5,"id":"api-166","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Spyware","details_count":4,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Contains ability to open the clipboard"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Grants permissions using icacls (DACL modification)"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":17,"imported_dlls_count":94,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":46,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","crypt","cve-2017-0147","downloader","ransomware","wanacrypt0r","wanaransomware","wannacry","wannacrypt","wcry"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","Simulated analysis","Network Traffic"],"sandbox_reports":[{"id":"64a65f79e3ea360dee01a29a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.WannaCryptor","submit_name":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","analysis_start_time":"2023-07-06T06:30:18+00:00","indicators_count":{"informative":182,"suspicious":77,"malicious":14},"tags":["Multi-Process","Extracted Files","Sample Crashed","Simulated analysis"],"is_in_unified_schema":true},{"id":"64a6585a8b1f27d8d30048d0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.WannaCryptor","contacted_countries":["USA"],"submit_name":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","analysis_start_time":"2023-07-06T05:59:55+00:00","indicators_count":{"informative":192,"suspicious":79,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"204.8.99.146","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"dns_resolutions":[{"domain":"dist.torproject.org","address":"204.8.99.146","ttl":105,"country":"United States","registrar_name":"CSL Computer Service Langenbach GmbH d/b/a joker.com a German GmbH","registrar_organization":"The Tor Project, Inc","registrar_name_servers":"NS1.TORPROJECT.ORG","registrar_creation_date":"2006-10-17T22:02:50+00:00","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}],"processes":[{"pid":3508,"ppid":0,"name":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.exe","command_line":"","sha256":"149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff","normalized_path":"C:\\149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff.exe","uid":"00000000-00003508","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7220,"ppid":3508,"name":"attrib.exe","command_line":"attrib +h .","sha256":"b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240","normalized_path":"%WINDIR%\\SysWOW64\\attrib.exe","parent_uid":"00000000-00003508","uid":"00000000-00007220"},{"pid":7472,"ppid":3508,"name":"icacls.exe","command_line":"icacls . /grant Everyone:F /T /C /Q","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00003508","uid":"00000000-00007472"},{"pid":7384,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00007384"},{"pid":1772,"ppid":3508,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c 4401688623538.bat","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003508","uid":"00000000-00001772"},{"pid":8068,"ppid":1772,"name":"cscript.exe","command_line":"//nologo m.vbs","sha256":"8d717ab837f26ecd2cc373d8ee3037798a115ba6a9ee958269f0cff056dc5cab","normalized_path":"%WINDIR%\\SysWOW64\\cscript.exe","parent_uid":"00000000-00001772","uid":"00000000-00008068"},{"pid":6044,"ppid":3508,"name":"@WanaDecryptor@.exe","command_line":"fi","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","normalized_path":"C:\\@WanaDecryptor@.exe","parent_uid":"00000000-00003508","uid":"00000000-00006044"},{"pid":5816,"ppid":3508,"name":"attrib.exe","command_line":"attrib +h +s Z:\\$RECYCLE","sha256":"b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240","normalized_path":"%WINDIR%\\SysWOW64\\attrib.exe","parent_uid":"00000000-00003508","uid":"00000000-00005816"},{"pid":7156,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00007156"},{"pid":2448,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00002448"},{"pid":7692,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00007692"},{"pid":5436,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00005436"},{"pid":7576,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00007576"},{"pid":7072,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00007072"},{"pid":5840,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00005840"},{"pid":6452,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00006452"},{"pid":7296,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00007296"},{"pid":6168,"ppid":3508,"name":"taskdl.exe","command_line":"","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","normalized_path":"C:\\taskdl.exe","parent_uid":"00000000-00003508","uid":"00000000-00006168"}],"all_imported_dlls":["shlwapi.dll","wldp.dll","uxtheme.dll","msasn1.dll","coml2.dll","cldapi.dll","wow64cpu.dll","sspicli.dll","fltLib.dll","cfgmgr32.dll","riched20.dll","user32.dll","win32u.dll","crypt32.dll","mfc42.dll","comctl32.dll","dwmapi.dll","winnsi.dll","bcrypt.dll","msvcp60.dll","msls31.dll","msctf.dll","ntdll.dll","advapi32.dll","ulib.dll","mpr.dll","KernelBase.dll","ole32.dll","kernel.appcore.dll","vbscript.dll","wshext.dll","wininet.dll","mswsock.dll","shell32.dll","version.dll","schannel.dll","kernel32.dll","combase.dll","oleaut32.dll","SHCore.dll","powrprof.dll","fsutilext.dll","ws2_32.dll","amsi.dll","rpcrt4.dll","bcryptprimitives.dll","windows.storage.dll","ntmarta.dll","iertutil.dll","dnsapi.dll","rasadhlp.dll","gdi32.dll","ucrtbase.dll","OnDemandConnRouteHelper.dll","winhttp.dll","wow64.dll","wow64win.dll","msvcrt.dll","VxSSL32.dll","cmdext.dll","urlmon.dll","imagehlp.dll","riched32.dll","gdi32full.dll","msvcp_win.dll","cryptsp.dll","wintrust.dll","usp10.dll","nsi.dll","FWPUCLNT.DLL","rsaenh.dll","profapi.dll","apphelp.dll","scrrun.dll","msIso.dll","cryptbase.dll","netutils.dll","imm32.dll","IPHLPAPI.DLL","sechost.dll","MpOAV.dll","clbcatq.dll","cryptnet.dll","ncryptsslp.dll","dpapi.dll","sxs.dll","msisip.dll","ncrypt.dll","gpapi.dll","scrobj.dll","mskeyprotect.dll","propsys.dll","ntasn1.dll","userenv.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"@WanaDecryptor@.exe","sha256":"b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"123901688625357.bat","sha256":"f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"m.vbs","sha256":"51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"taskdl.exe","sha256":"4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"taskse.exe","sha256":"2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"@Please_Read_Me@.txt","sha256":"840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"@WanaDecryptor@.exe.lnk","sha256":"02bb45e59a52922c167aa3e718192fb3219ad77593b8448db48ee4e2e42c02d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"WelcomeScan.jpg.WNCRYT","sha256":"7686d06a6d74852408616caf48ea0bd0b116197261308ffef22b205860636c8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"Open Notebook.onetoc2.WNCRYT","sha256":"6e90a45cf6eb82b956fe37abe16463fbf99039152a075a940e9a6b8b9da87624","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"4401688623538.bat","sha256":"f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"NisLog.txt.WNCRYT","sha256":"f0e13af06922aae581446a49926f38427783bc545c85c1f64f528ec218ab7f6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"files_written":[{"path":"C:\\msg\\m_danish.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_dutch.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_english.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_filipino.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_finnish.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_french.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_german.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_greek.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_italian.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_japanese.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_korean.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_latvian.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_norwegian.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_polish.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_portuguese.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_russian.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_slovak.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_spanish.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_swedish.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_turkish.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_vietnamese.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\r.wnry","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"C:\\taskse.exe","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\TaskData","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\~SDACF4.tmp","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\My Notebook\\@Please_Read_Me@.txt","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"%USERPROFILE%\\Documents\\OneNote Notebooks\\OneNote 2010 Guide\\Open Notebook.onetoc2.WNCRYT","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst.WNCRYT","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"%USERPROFILE%\\Desktop\\~SDAE5F.tmp","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"%PUBLIC%\\Documents\\~SDB000.tmp","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"C:\\$Recycle.Bin\\~SDB07F.tmp","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"C:\\$WINDOWS.~BT\\Sources\\~SDB132.tmp","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"C:\\found.000\\~SDB250.tmp","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"path":"C:\\msg\\m_chinese (simplified).wnry","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_chinese (traditional).wnry","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_croatian.wnry","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_czech.wnry","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_indonesian.wnry","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\msg\\m_romanian.wnry","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"C:\\00000000.eky","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\WANACRYPT0R\\","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"MsWinZonesCacheCounterMutexA","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Local\\SM0:6324:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"SM0:6324:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Local\\SM0:2828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"SM0:2828:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"},{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"SM0:6960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"Local\\SM0:6960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a65f79e3ea360dee01a29a"}]},{"name":"Local\\SM0:3508:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"SM0:3508:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"SM0:6044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Local\\SM0:6044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"SM0:8068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"SM0:8068:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Local\\SM0:8068:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]},{"name":"Local\\SM0:8068:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64a6585a8b1f27d8d30048d0"}]}]}},"report_ids":{"sandbox_job_ids":["64a65f79e3ea360dee01a29a","64a6585a8b1f27d8d30048d0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Ransom.WannaCryptor Sample 149601e15002… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 149601e15002…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.WannaCryptor Sample 149601e15002… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 149601e15002…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/149601e15002f78866ab73033eb8577f11bd489a4cea87b10c52a70fdf78d9ff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.WannaCryptor Sample 149601e15002… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 149601e15002…. Malware family: Trojan.Ransom.WannaCryptor. Threat score 100/100. 25/28 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L66","11",{}]]