24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4dc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_100% Sample 1831806fc27d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1831806fc27d…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","keywords":["Malicious","Win/grayware_confidence_100%","malware analysis","sandbox report","threat intelligence","1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"],"about":{"@type":"SoftwareApplication","name":"98154388263-107-0_AA_v3.exe_1.AA_v3.exe","applicationCategory":["peexe","executable"],"identifier":"1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_100%","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":36},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T946,Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "ERROR %d ImpersonateLoggedOnUser()" (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl() error=%u" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid() error=%u" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid() error=%u" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "ERROR: SetTokenInformation() error=%d" (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API "ERROR %d RevertToSelf()" (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "ERROR: DuplicateToken() error=%d" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "SetEntriesInAcl() error=%u" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API "InitializeSecurityDescriptor() error=%u" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin")26:T693c,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FreeContextBuffer"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageTimeoutA"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExtTextOutA"; Source: "sample.bin"), Found reference to API (Indicator: "IsIconic"; Source: "sample.bin"), Found reference to API (Indicator: "DrawIconEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemID"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "DrawEdge"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserGeoID"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetIconInfo"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "MapDialogRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "HttpSendRequestA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAIoctl"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EndUpdateResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RedrawWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "BeginUpdateResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "GetAdaptersInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyCursor"; Source: "sample.bin"), Found reference to API (Indicator: "SetScrollInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyMenu"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "HttpQueryInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadReadPtr"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuState"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQueryUserToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColorBrush"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiClassGuidsFromNameA"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityContextA"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "OpenMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalDrives"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowScrollBar"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenuItemInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "InsertMenuItemW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "InsertMenuItemA"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassExA"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "PostThreadMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SleepEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadKeyboardLayoutA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "DrawTextA"; Source: "sample.bin"), Found reference to API (Indicator: "WindowFromPoint"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualRect"; Source: "sample.bin"), Found reference to API (Indicator: "IntersectRect"; Source: "sample.bin"), Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WinStationQueryInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenDesktopA"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "AttachThreadInput"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpOpenRequestA"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardState"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "DrawMenuBar"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "CheckMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontA"; Source: "sample.bin"), Found reference to API (Indicator: "Shell_NotifyIconA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookExA"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceExA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetStretchBltMode"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SetRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; Source: "sample.bin"), Found reference to API (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateResourceA"; Source: "sample.bin"), Found reference to API (Indicator: "InternetConnectA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "ClientToScreen"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetSubMenu"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteService"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassNameA"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePatternBrush"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateAcceleratorTableA"; Source: "sample.bin"), Found reference to API (Indicator: "GetOpenFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "OpenInputDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "InternetSetOptionA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetSaveFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDialogMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SetupDiGetClassDevsA"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameA"; Source: "sample.bin"), Found reference to API (Indicator: "DPtoLP"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")27:T5b8,Found string "Please enter password for accessing remote computer" (Indicator: "password"; Source: "sample.bin"), Found string "The password you have entered is invalid, please try again" (Indicator: "password"; Source: "sample.bin"), Found string "Inserire la password di accesso al computer remoto" (Indicator: "password"; Source: "sample.bin"), Found string "-password" (Indicator: "password"; Source: "sample.bin"), Found string "Incorrect password for router %s" (Indicator: "password"; Source: "sample.bin"), Found string "La password inserita non " (Indicator: "password"; Source: "sample.bin"), Found string "Confirm password" (Indicator: "password"; Source: "sample.bin"), Found string "CHttpClient::HttpLogin(): username and password must be not empty." (Indicator: "password"; Source: "sample.bin"), Found string "Entry with new ID and password is already existed, but it will be replaced" (Indicator: "password"; Source: "sample.bin"), Found string "Leave password empty if no password authentication required. Use mouse double click for changing password" (Indicator: "password"; Source: "sample.bin"), Found string "The password was not correctly confirmed. Please ensure that the password and confirmation match exactly." (Indicator: "password"; Source: "sample.bin"), Found string "We don't recommend for security reason to create permission for ANY operator without password Do you want to continue?" (Indicator: "password"; Source: "sample.bin")28:T579,Found reference to API "ERROR: memory device doesn't support GetDIBits" (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API "ERROR#1 GetDIBits() error=%d, y=%d, cy=%d" (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API "GetDC" (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API "CreateCompatibleBitmap() ERROR=%d" (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API "GetDIBits()#2 ERROR=%d" (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API "ERROR: root device doesn't support BitBlt" (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API "GetDIBits()#1 ERROR=%d" (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API "GetDC(NULL) ERROR=%d" (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API "CreateCompatibleDC() ERROR=%d" (Indicator: "CreateCompatibleDC"; Source: "sample.bin")29:T733,Found reference to API "ReTranslator::DoSmart()#166 child socket was closed, error=%d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Couldn't connect to router %s:%d" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "ReTranslator::DoSmart()#139 Remote child socket was closed" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Error while connect to RDP server on remote side" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Error=%d WSAStartup()" (Indicator: "wsastartup"; Source: "sample.bin"), Found reference to API "ReTranslator::DoSmart()#165 child socket was closed, error=%d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "DoDirectConnect() couldn't listen port %d" (Indicator: " listen "; Source: "sample.bin"), Found reference to API "ReTranslator::DoSmart()#159 solid socket send error=%d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "ReTranslator::DoSmart()#159 solid socket send error=%d" (Indicator: " send "; Source: "sample.bin"), Found reference to API "Couldn't connect to routers %s" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "ReTranslator::SimpleSend (%X) send %d bytes" (Indicator: " send "; Source: "sample.bin"), Found reference to API "Can't connect to server" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "couldn't listen port %d, error = %d" (Indicator: " listen "; Source: "sample.bin"), Found reference to API "couldn't bind port %d, error = %d" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "ReTranslator::DoSmart()#159 solid socket read error=%d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "RunRDPclient#1 listen port=%d" (Indicator: " listen "; Source: "sample.bin")2a:T4dc,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: B3:5B:F6:AE:A6:84:BB:97:7A:55:07:3F:71:6A:05:B0:2E:B9:25:D9; see report for more information) The input sample is signed with a certificate issued by "CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE" (SHA1: F5:AD:0B:CC:1A:D5:6C:D1:50:72:5B:1C:86:6C:30:AD:92:EF:21:B0; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)2b:T6af,Found API call GetSystemTime@KERNEL32.DLL (Target: "AA_v3_1_.exe"; Stream UID: "00012761-00003904-37644-323-00408A1B") which is directly followed by "cmp esi, FFFFFFFFh" and "jne 00408A7Ch". See related instructions: "... +52 call dword ptr [00483288h] ;GetSystemTime +58 mov esi, eax +60 cmp esi, FFFFFFFFh +63 jne 00408A7Ch" ... at 00012761-00003904-37644-323-00408A1B Found API call GetSystemTime@KERNEL32.DLL (Target: "AA_v3_1_.exe"; Stream UID: "00012761-00003904-37644-348-00409A34") which is directly followed by "cmp edi, FFFFFFFFh" and "jne 00409A91h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 38h +6 push esi +7 push edi +8 mov esi, 004A1A64h +13 lea edi, dword ptr [ebp-0Ch] +16 movsd +17 movsw +19 mov al, byte ptr [ebp+08h] +22 movsb +23 add byte ptr [ebp-08h], al +26 xor esi, esi +28 push esi +29 push esi +30 push 00000003h +32 push esi +33 push 00000003h +35 lea eax, dword ptr [ebp-0Ch] +38 push esi +39 push eax +40 call dword ptr [00483288h] ;GetSystemTime +46 mov edi, eax +48 cmp edi, FFFFFFFFh +51 jne 00409A91h" ... at 00012761-00003904-37644-348-00409A34 Found API call GetSystemTime@KERNEL32.DLL (Target: "AA_v3_1_.exe"; Stream UID: "00012761-00003904-37644-342-0040904C") which is directly followed by "cmp eax, FFFFFFFFh" and "jne 004090A3h". See related instructions: "... +40 call dword ptr [00483400h] +46 add esp, 0Ch +49 xor ebx, ebx +51 lea eax, dword ptr [ebp-00000084h] +57 push ebx +58 push ebx +59 push 00000003h +61 push ebx +62 push 00000003h +64 push ebx +65 push eax +66 call dword ptr [00483288h] ;GetSystemTime +72 cmp eax, FFFFFFFFh +75 mov dword ptr [ebp+0Ch], eax +78 jne 004090A3h" ... at 00012761-00003904-37644-342-0040904C2c:T4f4,send (Ordinal #19) recv (Ordinal #16) WSAStartup (Ordinal #115) connect (Ordinal #4) accept (Ordinal #1) bind (Ordinal #2) listen (Ordinal #13) socket (Ordinal #23) closesocket (Ordinal #3) FindWindowA FindWindowW SetWindowsHookExA GetWindowThreadProcessId ShellExecuteA ShellExecuteExW ShellExecuteW RegOpenKeyExA SetSecurityDescriptorDacl OpenProcessToken RegCloseKey GetUserNameA StartServiceCtrlDispatcherW CreateProcessAsUserW CreateServiceW StartServiceA StartServiceW RegCreateKeyExA RegDeleteKeyA RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW HttpSendRequestA HttpQueryInfoA InternetConnectA InternetCloseHandle InternetReadFile InternetOpenA LockResource FindResourceExA LoadLibraryW OpenProcess CreateToolhelp32Snapshot Process32First Process32Next LoadLibraryA GetFileSize WriteFile CreateThread GetFileAttributesW GetStartupInfoW CreateProcessW GetModuleFileNameW GetComputerNameA DeleteFileW GetTempPathW CreateFileW FindFirstFileW CreateFileA DeviceIoControl GetModuleHandleA GetProcAddress CreateDirectoryW GetVersionExA Sleep GetTickCount TerminateProcess GetFileSizeEx GetDriveTypeW FindNextFileW SleepEx CreateDirectoryA DeleteFileA FindResourceA GetStartupInfoA2d:T411,"AA_v3.5.exe" called "GetWindowTextW" with parameter "Start" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Stop" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "View only" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Connect" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Connecting to 136.243.104.235:443" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Connected to 136.243.104.235:443" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Sent initial message to router 136.243.104.235" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Established connection to router 136.243.104.235:443" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Stopping" - (UID: 00000000-00005096) "AA_v3.5.exe" called "GetWindowTextW" with parameter "Stopped" - (UID: 00000000-00005096)2e:T13b6,"AA_v3.5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007512) "AA_v3.5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007512) "AA_v3.5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007760) "AA_v3.5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007760) "AA_v3.5.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007760) "AA_v3.5.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005096) "AA_v3.5.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005096) "AA_v3.5.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005096)2f:T5da,"AA_v3.5.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005cf44a000c0000005cf44a0008b64200 (UID: 00000000-00007512) "AA_v3.5.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bc2d26039c2d260300000000 (UID: 00000000-00007760) "AA_v3.5.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005cf44a000c0000005cf44a0008b64200 (UID: 00000000-00005096) "AA_v3.5.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000000000b05d76041f001e0068088b046400000028ea8f00b4ad42000400000028ea8f0028ea8f000cea8f006570dc7600007604000000008470dc764a5f88ee88ea8f0028ea8f0000000000000076040500000088ea8f0005000000d4e98f00638e42002cea8f0070c8dd760100000088ea8f00010000005cea8f00638e4200 (UID: 00000000-00005096)30:T4de,"AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007512) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007512) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007512) "AA_v3.5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007512) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007760) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007760) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007760) "AA_v3.5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007760) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005096) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005096) "AA_v3.5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005096) "AA_v3.5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005096)31:T3bd9,"AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007512) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007760) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilter (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005096) "AA_v3.5.exe" called "GetProcAddress" with a parameter GetUserGeoID (UID: 00000000-00005096)32:T6d6,"AA_v3.5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761e0000 "AA_v3.5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761e0000 "AA_v3.5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761e0000 "AA_v3.5.exe" loaded module "KERNEL32" at base 76820000 "AA_v3.5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72af0000 "AA_v3.5.exe" loaded module "KERNEL32.DLL" at base 76820000 "AA_v3.5.exe" loaded module "RPCRT4.DLL" at base 75310000 "AA_v3.5.exe" loaded module "NTDLL.DLL" at base 76ea0000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73370000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 753d0000 "AA_v3.5.exe" loaded module "COMCTL32.DLL" at base 70fd0000 "AA_v3.5.exe" loaded module "OLEAUT32.DLL" at base 74f00000 "AA_v3.5.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76010000 "AA_v3.5.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76010000 "AA_v3.5.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 763c0000 "AA_v3.5.exe" loaded module "SSPICLI.DLL" at base 738c0000 "AA_v3.5.exe" loaded module "USER32.DLL" at base 76010000 "AA_v3.5.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 725e0000 "AA_v3.5.exe" loaded module "WINHTTP.DLL" at base 72530000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 725e0000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72b70000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72510000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 724c0000 "AA_v3.5.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75cb000033:T536,"AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")34:T9f4,"AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "AA_V3.5.EXE"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")35:T4d4,"AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY (UID: 00000000-00007512) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\hr3 (UID: 00000000-00007512) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\hr (UID: 00000000-00007512) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\settings3.bin (UID: 00000000-00007512) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\settings.bin (UID: 00000000-00007512) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY (UID: 00000000-00005096) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\settings.bin (UID: 00000000-00005096) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\ammyy.log (UID: 00000000-00005096) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\settings.rdp (UID: 00000000-00005096) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\_tmp\AMMYY_Admin.exe (UID: 00000000-00005096) "AA_v3.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\AMMYY\settings3.bin (UID: 00000000-00005096)36:T89d,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "AA_v3.5.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "AA_v3.5.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "AA_v3.5.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "AA_v3.5.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "AA_v3.5.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "AA_v3.5.exe") Found reference to API "GetDIBits()#2 ERROR=%d" (Indicator: "GetDIBits"; File: "AA_v3.5.exe") Found reference to API "GetDIBits()#1 ERROR=%d" (Indicator: "GetDIBits"; File: "AA_v3.5.exe") Found reference to API "CreateCompatibleBitmap() ERROR=%d" (Indicator: "CreateCompatibleBitmap"; File: "AA_v3.5.exe") Found reference to API "ERROR: memory device doesn't support GetDIBits" (Indicator: "GetDIBits"; File: "AA_v3.5.exe") Found reference to API "ERROR: root device doesn't support BitBlt" (Indicator: "BitBlt"; File: "AA_v3.5.exe") Found reference to API "CreateCompatibleDC() ERROR=%d" (Indicator: "CreateCompatibleDC"; File: "AA_v3.5.exe") Found reference to API "GetDC(NULL) ERROR=%d" (Indicator: "GetDC"; File: "AA_v3.5.exe") Found reference to API "ERROR#1 GetDIBits() error=%d, y=%d, cy=%d" (Indicator: "GetDIBits"; File: "AA_v3.5.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp")37:T832,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "AA_v3.5.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "AA_v3.5.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "AA_v3.5.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "AA_v3.5.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "AA_v3.5.exe") Found reference to API "RegQueryValueEx("NetCfgInstanceId") ERROR=%d" (Indicator: "RegQueryValue"; File: "AA_v3.5.exe") Found reference to API "RegOpenKey(%s) Error=%d" (Indicator: "RegOpenKey"; File: "AA_v3.5.exe") Found reference to API "RegOpenKeyExA() error=%u" (Indicator: "RegOpenKey"; File: "AA_v3.5.exe") Found reference to API "RegQueryValueExA() error=%u" (Indicator: "RegQueryValue"; File: "AA_v3.5.exe") Found reference to API "RegQueryValueExW() error=%u" (Indicator: "RegQueryValue"; File: "AA_v3.5.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "RegOpenKeyExA() error=%u" (Indicator: "RegOpenKey"; Source: "00000000-00005096.00000002.131030.004A5000.00000004.mdmp") Found reference to API "RegQueryValueExA() error=%u" (Indicator: "RegQueryValue"; Source: "00000000-00005096.00000002.131030.004A5000.00000004.mdmp") Found reference to API "RegQueryValueExW() error=%u" (Indicator: "RegQueryValue"; Source: "00000000-00005096.00000002.131030.004A5000.00000004.mdmp")38:T568,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "AA_v3.5.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "AA_v3.5.exe") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; File: "AA_v3.5.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "AA_v3.5.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "AA_v3.5.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "AA_v3.5.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "VkKeyScanExA" (Indicator: "VkKeyScan"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp")39:T7f2,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "AA_v3.5.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "AA_v3.5.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "AA_v3.5.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "AA_v3.5.exe") Found reference to API "WARN: GetProcAddress('WTSQueryUserToken') error=%d" (Indicator: "WTSQueryUserToken"; File: "AA_v3.5.exe") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "AA_v3.5.exe") Found reference to API "ERROR %d OpenProcessToken()" (Indicator: "OpenProcessToken"; File: "AA_v3.5.exe") Found reference to API "ERROR: WTSQueryUserToken() error=%d" (Indicator: "WTSQueryUserToken"; File: "AA_v3.5.exe") Found reference to API "ERROR %d GetUserName()" (Indicator: "GetUserName"; File: "AA_v3.5.exe") Found reference to API "ERROR: OpenProcessToken() error=%d" (Indicator: "OpenProcessToken"; File: "AA_v3.5.exe") Found reference to API "GetUserObjectInformation() error=%d" (Indicator: "GetUserObjectInformation"; File: "AA_v3.5.exe") Found reference to API "3179,,GetUserNameExW,secur32" (Indicator: "GetUserName"; Source: "00000000-00005096.00000000.127191.02A50000.00000004.mdmp, 00000000-00005096.00000001.129113.02A50000.00000004.mdmp, 00000000-00005096.00000002.131030.02A50000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00005096.00000001.129113.00483000.00000002.mdmp")3a:T689,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: AA_v3.5.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: AA_v3.5.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: AA_v3.5.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AA_v3.5.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: AA_v3.5.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: AA_v3.5.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: AA_v3.5.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: AA_v3.5.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: AA_v3.5.exe] Observed import api "SetFileSecurityW" which can "Sets the security of a file or directory object" [Source: AA_v3.5.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: AA_v3.5.exe] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: AA_v3.5.exe]3b:T9ac,"AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "AA_v3.5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3c:T5a4,"AA_v3.5.exe" called "GetAdaptersInfo" (UID: 00000000-00005096) "AA_v3.5.exe" called "GetAdaptersInfo" with parameter "00000000090000007b44303344423043312d323732392d343637342d413837352d3836323544443738343330307d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204e6574776f726b20436f6e6e656374696f6e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000009a100bf35df5000009000000060000000100000000000000000000003139322e3136382e302e3200000000003235352e3235352e3235352e30000000c0a80002000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b092cc668c98cc66742ff6c864510000" - (UID: 00000000-00005096)3d:T75e,"AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\AMMYY\ADMIN"; Key: "HR"; Value: "S}Vsf1") "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\AMMYY\ADMIN"; Key: "HR"; Value: "S}Vsf1") "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\AMMYY\ADMIN"; Key: "HR3"; Value: "01DF7D6E6110D883ACC3AEBA3DB8ABE44DD11A596D0EDC97ED1AA0A955E631190B090A77589DBBB3704F9E643D3036BDEC8DBF2E5BB3F1B50DE093566F896F049BCB2F37C4D93421281DEA28D2F4E7F434508DA5BAAE0023DDBAC81D871D") "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\AMMYY\ADMIN"; Key: "HR3"; Value: "01DF7D6E6110D883ACC3AEBA3DB8ABE44DD11A596D0EDC97ED1AA0A955E631190B090A77589DBBB3704F9E643D3036BDEC8DBF2E5BB3F1B50DE093566F896F049BCB2F37C4D93421281DEA28D2F4E7F434508DA5BAAE0023DDBAC81D871D") "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\NETWORK\AMMYYADMIN_1D58"; Key: "(DEFAULT)"; Value: "Service"), "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "0000"), "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\AMMYY\ADMIN"; Key: "HR"; Value: "S}Vsf"), "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\AMMYY\ADMIN"; Key: "HR"; Value: "S}Vsf"), "AA_v3.5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\AMMYY\ADMIN"; Key: "HR3"; Value: "w}(v[\" created file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00012761-00003904-42650-137-00423171\n listen@WS2_32.DLL at 00012761-00003904-37644-150-00423171\n listen@WS2_32.DLL at 00012761-00003904-37644-1433-00423F97","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00012761-00003904-42650-431-0041C1DA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 45861-2893-004423E6\n OpenClipboard@USER32.dll at 45861-3069-004425E0\n OpenClipboard@USER32.dll at 45861-2760-00433A2F\n OpenClipboard@USER32.DLL at 00012761-00003904-37644-1605-00433A2F\n OpenClipboard@USER32.DLL at 00012761-00003904-37644-1739-004423E6\n OpenClipboard@USER32.DLL at 00012761-00003904-37644-1915-004425E0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.dll at 45861-2648-0043ECC2\n GetAsyncKeyState@USER32.dll at 45861-3890-0044C49B\n GetAsyncKeyState@USER32.dll at 45861-3046-0044C393\n GetKeyboardState@USER32.dll at 45861-3022-00440736\n GetAsyncKeyState@USER32.dll at 45861-2939-0043AA2D\n GetAsyncKeyState@USER32.dll at 45861-3044-0044C3D2\n GetAsyncKeyState@USER32.DLL at 00012761-00003904-37644-1890-0044C3D2\n GetKeyboardState@USER32.DLL at 00012761-00003904-37644-1868-00440736\n GetKeyboardState@USER32.DLL at 00012761-00003904-37644-1493-0043ECC2\n GetAsyncKeyState@USER32.DLL at 00012761-00003904-37644-1892-0044C393\n GetAsyncKeyState@USER32.DLL at 00012761-00003904-37644-1785-0043AA2D\n GetAsyncKeyState@USER32.DLL at 00012761-00003904-37644-2739-0044C49B","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00012761-00003904-42650-195-0040B560\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00012761-00003904-42650-496-0044E7E9","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2c","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053257758582677186a2677653c27770000000000bff9760000000056ccf976000000007ccaf97600000000376862756a2c2777d62d277700000000206962750000000029a6f97600000000a48d627500000000f70ef97600000000\" to virtual address \"0x773A1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"malicious","category":"Environment Awareness","name":"Queries disc information (often used to evade virtual machines)","description":"\"\" queried disc information using control code IOCTL_DISK_GET_DRIVE_GEOMETRY_EX","origin":"API Call","relevance":5,"id":"api-48","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO POLICY RemoteAdmin Win32.Ammyy.z Checkin\" (SID: 2806289, Rev: 10, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/56 Antivirus vendors marked sample as malicious (30% detection rate)\n 11/43 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/56 Antivirus vendors marked sample as malicious (30% detection rate)\n 11/43 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00012761-00003904-42650-333-00409A34\n DeviceIoControl@KERNEL32.DLL at 00012761-00003904-42650-326-00409481\n DeviceIoControl@KERNEL32.DLL at 00012761-00003904-42650-328-00409414\n DeviceIoControl@KERNEL32.DLL at 00012761-00003904-42650-308-00408A1B","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"malicious","category":"Installation/Persistance","name":"Deletes safeboot related registry keys","description":"\"\" (Access type: \"DELETE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_F40\")","origin":"Registry Access","relevance":8,"id":"registry-14","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"176.56.184.37\" (ASN: 41095, Owner: IPTriplePlay Ltd): ...\nURL: http://rl.ammyy.com/ (AV positives: 1/67 scanned on 05/03/2016 14:32:06)\n File SHA256: 90ba94beb874e59673cfb960508063403db4b34730078333e74559a6479f8d64 (AV positives: 9/57 scanned on 05/02/2016 20:51:12)\n File SHA256: f9482fff5aed596eb0407a11c1c41a74b4de09f88a7e58c47d18967b1c900010 (AV positives: 28/57 scanned on 05/01/2016 02:15:36)\n File SHA256: 8ffa49ed63db98b5da9c4b6426275875b5c4b9d0d77db99bae9f252262378913 (AV positives: 50/56 scanned on 04/30/2016 02:32:20)\n File SHA256: 2a64d7906b3d82c0b2e0f44d6c784cbd5c5987b3a03ad7c5c93861c7de101029 (AV positives: 38/57 scanned on 04/29/2016 00:44:29)\n File SHA256: 0a78d0b1bb4442ca5298ca4626606f9acb4d78798e1d1369b79024177bf14e9e (AV positives: 20/55 scanned on 04/15/2016 15:38:32)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Ammyy_Admin_AA_v3\" matched file \"AA_v3_1_.exe.bin\" as \"Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe\" based on indicators: \"S:\\Ammyy\\sources\\target\\TrService.cpp,S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp,Global\\Ammyy.Target.IncomePort,S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp,Please enter password for accessing remote computer,CreateProcess1()#3 %d error=%d,CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name.,ERROR: CreateProcessAsUser() error=%d, session=%d,ERROR: FindProcessByName('explorer.exe')\" (Reference: http://goo.gl/gkAg2E, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400\n \"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode \"IOCTL_DISK_GET_DRIVE_GEOMETRY_EX\" (0x700a0)","origin":"API Call","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"AA_v3.5.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4945624'}\" (UID: 00000000-00007512)\n \"AA_v3.5.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4945624'}\" (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AA_v3.5.exe\")\n Found reference to API \"CreateThread() Error %d\" (Indicator: \"CreateThread\"; File: \"AA_v3.5.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"POST\" in header \"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: rl.ammyy.comContent-Length: 220Cache-Control: no-cache\"\n Contains base64 string in header \"1Content\" in header \"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: rl.ammyy.comContent-Length: 220Cache-Control: no-cache\"\n Contains base64 string in header \"Type\" in header \"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: rl.ammyy.comContent-Length: 220Cache-Control: no-cache\"\n Contains base64 string in header \"form\" in header \"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: rl.ammyy.comContent-Length: 220Cache-Control: no-cache\"\n Contains base64 string in header \"220Cache\" in header \"POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: rl.ammyy.comContent-Length: 220Cache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"AA_v3.5.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2d","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"AA_v3.5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007512)\n \"AA_v3.5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007760)\n \"AA_v3.5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"AA_v3.5.exe\" called \"OpenMutexA\" with parameter \"Global\\Ammyy.Target.IncomePort\" - (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"AA_v3.5.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"AA_v3.5.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"AA_v3.5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"AA_v3.5.exe\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"AA_v3.5.exe\")\n Found reference to API \"GetUserObjectInformation() error=%d\" (Indicator: \"GetUserObjectInformation\"; File: \"AA_v3.5.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"AA_v3.5.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"AA_v3.5.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"AA_v3.5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"AA_v3.5.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\\INSTANCES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"AA_v3.5.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\AMMYY\\ (UID: 00000000-00007512)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"AA_v3.5.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"AA_v3.5.exe\")\n Found reference to API \"RegCreateKeyExA() error=%u\" (Indicator: \"RegCreateKey\"; File: \"AA_v3.5.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA() error=%u\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005096.00000002.131030.004A5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AA_v3.5.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"AA_v3.5.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"AA_v3.5.exe\")\n Found reference to API \"ERROR %d OpenProcessToken()\" (Indicator: \"OpenProcess\"; File: \"AA_v3.5.exe\")\n Found reference to API \"ERROR %d OpenProcess()\" (Indicator: \"OpenProcess\"; File: \"AA_v3.5.exe\")\n Found reference to API \"ERROR: OpenProcessToken() error=%d\" (Indicator: \"OpenProcess\"; File: \"AA_v3.5.exe\")\n Found reference to API \"ERROR: OpenProcess(%u) error=%d\" (Indicator: \"OpenProcess\"; File: \"AA_v3.5.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"AA_v3.5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75C00000\n \"AA_v3.5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72C40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"AA_v3.5.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75310000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"AA_v3.5.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"AA_v3.5.exe\" was detected as \"Microsoft Visual C++\" and name: \"Compiler\"\n \"AA_v3.5.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"AA_v3.5.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"AA_v3.5.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"AA_v3.5.exe\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x48eb08,push\t0x47c570,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x68,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,xor\tebx, ebx,mov\tdword ptr [ebp - 4], ebx,push\t2,call\tdword ptr [0x4833a4],pop\tecx,or\tdword ptr [0x4b6d38], 0xffffffff,or\tdword ptr [0x4b6d3c], 0xffffffff,call\tdword ptr [0x4833a8],mov\tecx, dword ptr [0x4b6d20],mov\tdword ptr [eax], ecx,call\tdword ptr [0x4833ac],mov\tecx, dword ptr [0x4b6d1c],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x4833b0],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AA_v3.5.exe\" (UID: 00000000-00007760) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\"\n Process \"AA_v3.5.exe\" (UID: 00000000-00007760) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"\n Process \"AA_v3.5.exe\" (UID: 00000000-00005096) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"AA_v3.5.exe\" (UID: 00000000-00005096) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"rl.ammyy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AA_v3.5.exe\" searching for class \"AmmyyAdmin3Main\"\n \"AA_v3.5.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AA_v3.5.exe\" with commandline \"-service -lunch\" (UID: 00000000-00007760)\n Spawned process \"AA_v3.5.exe\" (UID: 00000000-00005096)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AA_v3.5.exe\" with commandline \"-service -lunch\" (UID: 00000000-00007760)\n Spawned process \"AA_v3.5.exe\" (UID: 00000000-00005096)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"AA_v3.5.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"AA_v3.5.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"AA_v3.5.exe\" queries basic process information of the \"C:\\AA_v3.5.exe\" (UID: 7512)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"AA_v3.5.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"AA_v3.5.exe\" reads file \"c:\\programdata\\ammyy\\settings3.bin\"\n \"AA_v3.5.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Calls an API typically used to enumerate device information\n Matched sigs: Calls an API typically used to find device information","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\AA_v3.5.exe\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\AA_V3.5.EXE.LOCAL\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\MSVCP60.DLL\"\n \"AA_v3.5.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp60.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"AA_v3.5.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\"\n \"AA_v3.5.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\"\n \"AA_v3.5.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"AA_v3.5.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"AA_v3.5.exe\" touched file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"AA_v3.5.exe\" touched file \"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"AA_v3.5.exe\" touched file \"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"AA_v3.5.exe\" touched file \"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"AA_v3.5.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\MSVCP60.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\SECUR32.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\USERENV.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\WININET.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\DSOUND.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\WINMM.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\WINMMBASE.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\DEVOBJ.DLL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\DEVOBJ.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"AA_v3.5.exe\" trying to access non-existent file \"C:\\AA_V3.5.EXE.LOCAL\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\ProgramData\\AMMYY\\_TMP\"\n \"AA_v3.5.exe\" trying to access non-existent file \"C:\\AA_v3.5.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"AA_v3.5.exe\" writes file \"c:\\programdata\\ammyy\\hr\"\n \"AA_v3.5.exe\" writes file \"c:\\programdata\\ammyy\\hr3\"\n \"AA_v3.5.exe\" writes file \"c:\\programdata\\ammyy\\settings3.bin\"\n \"AA_v3.5.exe\" writes file \"%allusersprofile%\\ammyy\\hr\"\n \"AA_v3.5.exe\" writes file \"%allusersprofile%\\ammyy\\hr3\"\n \"AA_v3.5.exe\" writes file \"%allusersprofile%\\ammyy\\settings3.bin\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"AA_v3.5.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"AA_v3.5.exe\" called \"InternetReadFile\" with parameter 4096 (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"AA_v3.5.exe\" called \"InternetOpenA\" (UID: 00000000-00005096)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://rl.ammyy.com/http://rl.ammyy.com/http://rl.ammyy.com/rrd$srrrx8sr\" - Source: \"00000000-00005096.00000000.127191.02A50000.00000004.mdmp\")\n Found URL \"http://rl.ammyy.coms:\\ammyy\\sources\\ammyy\" - Source: \"00000000-00005096.00000000.127191.04760000.00000004.mdmp\")\n Found URL \"http://www.ammyy.com/microsoft\" - Source: \"00000000-00005096.00000001.129113.004B7000.00000002.mdmp\")\n Found URL \"http://rl.ammyy.com/http://rl.ammyy.com/http://rl.ammyy.com/rrd$srrrx8sr\" - Source: \"00000000-00005096.00000001.129113.02A50000.00000004.mdmp\")\n Found URL \"http://rl.ammyy.coms:\\ammyy\\sources\\ammyy\" - Source: \"00000000-00005096.00000001.129113.04760000.00000004.mdmp\")\n Found URL \"http://rl.ammyy.com/http://rl.ammyy.com/http://rl.ammyy.com/rrd$srrrx8sr\" - Source: \"00000000-00005096.00000002.131030.02A50000.00000004.mdmp\")\n Found URL \"http://rl.ammyy.coms:\\ammyy\\sources\\ammyy\" - Source: \"00000000-00005096.00000002.131030.04760000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://secure.comodo.net\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"136.243.104.235\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"771819875\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"302057819\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"302057819\"\n \"cx\": \"20\"\n \"cy\": \"80\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"302057819\"\n \"cx\": \"9\"\n \"cy\": \"36\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"771819875\"\n \"cx\": \"100\"\n \"cy\": \"18\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"771819875\"\n \"cx\": \"164\"\n \"cy\": \"18\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"771819875\"\n \"cx\": \"164\"\n \"cy\": \"25\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"771819875\"\n \"cx\": \"210\"\n \"cy\": \"25\"}\n \"AA_v3.5.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"302057819\"\n \"cx\": \"110\"\n \"cy\": \"25\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"AA_v3.5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"AA_v3.5.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"AA_v3.5.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: AA_v3.5.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{05F5CFE2-4733-4950-A6BB-07AAD01A3A84}\"; Key: \"CLASS\")\n \"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{091BC97E-2352-4362-A539-10A6D8FF7596}\"; Key: \"CLASS\")\n \"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{1264760F-A5C8-4BFE-B314-D56A7B44A362}\"; Key: \"CLASS\")\n \"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{13E42DFA-85D9-424D-8646-28A70F864F9C}\"; Key: \"CLASS\")\n \"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{14B62F50-3F15-11DD-AE16-0800200C9A66}\"; Key: \"CLASS\")\n \"AA_v3.5.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\0012\"; Key: \"NETCFGINSTANCEID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005096.00000000.127191.02A50000.00000004.mdmp, 00000000-00005096.00000001.129113.02A50000.00000004.mdmp, 00000000-00005096.00000002.131030.02A50000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005096.00000000.127191.02A50000.00000004.mdmp, 00000000-00005096.00000001.129113.02A50000.00000004.mdmp, 00000000-00005096.00000002.131030.02A50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"AA_v3.5.exe\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"AA_v3.5.exe\")\n Found reference to API \"RegDeleteKeyA() error=%u\" (Indicator: \"RegDeleteKey\"; File: \"AA_v3.5.exe\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00005096.00000001.129113.00483000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA() error=%u\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00005096.00000002.131030.004A5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: AA_v3.5.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"AA_v3.5.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"AA_v3.5.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"AA_v3.5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"AA_v3.5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"AA_v3.5.exe\" has section name .text with entropy \"6.70478471275\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%ALLUSERSPROFILE%\\AMMYY\\settings3.bin\" has high entropy 7.355827685129582","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"AA_v3.5.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: rl.ammyy.com\nContent-Length: 220\nCache-Control: no-cache\" with payload::==> \"v=3.5&d=FeEEEIJnZVBz1IJAZUBoEH5o6OF6WVAe5hAe5hEr6QFfbGEr6Hit6hiq6EEE5REt5qEE6gys4hAs5HEeMOEr5H5t4hIo5hOuEEIEEEEESJYP0hIFEEEEEFAEEEEq5HEq5HEq5OFURTbFSASeTABQTJTFRGFROTPF1IfFSAOePJ22TASE5HEq5HEq5HEq5HEq5HEq5HEq5REEEEIEEEEE\" HTTP/1.1 200 OK\nDate: Mon\n 26 Aug 2024 07:35:42 GMT\nServer: Apache\nX-Powered-By: PHP/5.4.16\nContent-Length: 138\nContent-Type: text/html with response body ==>524C2D2D466545454545457A3648417735484578364F45723574576F35684F7434684971364779733574533036484F7434486571344865714D48463835523577.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"AA_v3.5.exe\" called \"OpenServiceA\" to access the \"AmmyyAdmin_1D58\" service requesting \"SERVICE_ALL_ACCESS\" (0XF01FF) access rights","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 188.42.129.148 on port 80 is sent without HTTP header\n TCP traffic to 136.243.104.235 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"AA_v3.5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"AA_v3.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"AA_v3.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"AA_v3.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"AA_v3.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"AA_v3.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$3c","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Ping timeout was expired\" (Indicator: \"ping\"; File: \"AA_v3.5.exe\")\n Found string \"Ping time (ms) min-avr-max %2.2f %2.2f %2.2f loops=%u\" (Indicator: \"ping\"; File: \"AA_v3.5.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO IP Check (rl. ammyy. com)\" (SID: 2025149, Rev: 7, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"AA_v3.5.exe\" wrote 00000004 bytes to a remote process \"C:\\AA_v3.5.exe\" (Handle: 688)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.dll at 27584-3325-00408356\n GetUserDefaultUILanguage@KERNEL32.DLL at 00014559-00002500-35886-455-0041E984\n GetUserDefaultUILanguage@KERNEL32.DLL at 00014559-00002500-35886-2131-00408356","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"settings3.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.dll at 27584-2481-0041FEC5\n OpenServiceA@ADVAPI32.DLL at 00014559-00002500-35886-266-004206DD\n OpenServiceA@ADVAPI32.DLL at 00014559-00002500-35886-277-0042018C\n OpenServiceA@ADVAPI32.DLL at 00014559-00002500-35886-1277-0041FEC5","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00014559-00002500-35886-99-0042415C\n InternetReadFile@WININET.DLL at 00014559-00002500-35886-415-004280B9\n recv@WS2_32.DLL at 00014559-00002500-35886-919-004018E5\n recv@WS2_32.DLL at 00014559-00002500-35886-1374-0041E58A\n recv@WS2_32.DLL at 00014559-00002500-35886-1407-00424C15\n recv@WS2_32.DLL at 00014559-00002500-35886-1399-00424997\n recv@WS2_32.DLL at 00014559-00002500-35886-1371-0041E37F\n recv@WS2_32.DLL at 00014559-00002500-35886-1353-0041D4C1","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 2147483648)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 2147483648)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"keybd_event@USER32.dll at 27584-3028-004410E3\n mouse_event@USER32.dll at 27584-3047-0044111A\n keybd_event@USER32.DLL at 00014559-00002500-35886-1831-004410E3\n mouse_event@USER32.DLL at 00014559-00002500-35886-1850-0044111A","origin":"Hybrid Analysis Technology","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API ChangeWindowMessageFilter@USER32.DLL at 00014065-00003860-58730-1214-00425064","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://www.ammyy.com/\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://www.ammyy.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetUserGeoID\" (Source: AA_v3.exe.bin, API is part of module: KERNEL32.DLL)\n Found string \"GetNativeSystemInfo\" (Source: AA_v3.exe.bin, API is part of module: KERNEL32.DLL)\n Found string \"freeaddrinfo\" (Source: AA_v3.exe.bin, API is part of module: WS2_32.DLL)\n Found string \"getnameinfo\" (Source: AA_v3.exe.bin, API is part of module: WS2_32.DLL)\n Found string \"getaddrinfo\" (Source: AA_v3.exe.bin, API is part of module: WS2_32.DLL)\n Found string \"WTSGetActiveConsoleSessionId\" (Source: AA_v3.exe.bin, API is part of module: KERNEL32.DLL)\n Found string \"ChangeWindowMessageFilter\" (Source: AA_v3.exe.bin, API is part of module: USER32.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: AA_v3.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: AA_v3.exe.bin, API is part of module: KERNELBASE.DLL)\n Found string \"QueryDisplayConfig\" (Source: AA_v3.exe.bin, API is part of module: USER32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00014065-00003860-58730-1417-0042A117\n NtdllDefWindowProc_W@NTDLL.DLL at 00014065-00003860-58730-1565-00431CE8\n NtdllDefWindowProc_W@NTDLL.DLL at 00014065-00003860-58730-1493-004308DF\n NtdllDefWindowProc_W@NTDLL.DLL at 00014065-00003860-58730-1496-00430D29\n NtdllDefWindowProc_W@NTDLL.DLL at 00014065-00003860-58730-1765-0043AAD6","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"AA_v3.5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AA_V3.5.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"AA_v3.5.exe\" touched \"Computer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /v2/content/b9dc511e4c8db214bd54c88ee21f9a295a484e24?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F33074900-9c8c-4d97-8003-8e943f9aef7a&profile=1048832&CacheId=7 HTTP/1.1Connection: Keep-Alive\n Accept: */*\n Accept-Encoding: gzip\n deflate\n User-Agent: Microsoft-Delivery-Optimization/10.1\n MS-CV: P5DzmeHuEU+g9aOx.32.3.1.0.0.10.1.1.1.2.1.1\n Content-Length: 0\n Host: disc601.prod.do.dsp.mp.microsoft.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://disc601.prod.do.dsp.mp.microsoft.com/v2/content/b9dc511e4c8db214bd54c88ee21f9a295a484e24?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F33074900-9c8c-4d97-8003-8e943f9aef7a&profile=1048832&CacheId=7","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"name":"Spyware/Leak","details_count":3,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"intel_graph":{"map":{"Domain:6e4a44da8a6499f33a358e25d0a7da77e0e0738b72ce7bf1eb09739e64b1dc46":{"type":"Domain","value":"rl.ammyy.com","verdict":{"verdict":"unknown"}},"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed":{"type":"File","value":"1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus","likely malicious file"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:2cf54dd36af7a64ea55fb2c66090fb525751e5e05ecac336ca8876d9d2b5a88e":{"type":"File","value":"2cf54dd36af7a64ea55fb2c66090fb525751e5e05ecac336ca8876d9d2b5a88e","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:5f57ed1a89d94f7068d1e7fa6d284ec1d03fb806bc8d146e426c9da1c933d3b5":{"type":"File","value":"5f57ed1a89d94f7068d1e7fa6d284ec1d03fb806bc8d146e426c9da1c933d3b5"},"File:91456221184bf9803754805cdd964051de3cb27455a4d12b56ddda9028a39e82":{"type":"File","value":"91456221184bf9803754805cdd964051de3cb27455a4d12b56ddda9028a39e82"},"File:a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480":{"type":"File","value":"a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480"},"Ip:136.243.104.235":{"type":"Ip","value":"136.243.104.235"},"Ip:136.243.104.242":{"type":"Ip","value":"136.243.104.242"},"Ip:176.56.184.37":{"type":"Ip","value":"176.56.184.37"},"Ip:188.42.129.148":{"type":"Ip","value":"188.42.129.148"},"Ip:209.239.123.75":{"type":"Ip","value":"209.239.123.75"},"Ip:95.211.242.83":{"type":"Ip","value":"95.211.242.83"},"Ip:95.211.242.84":{"type":"Ip","value":"95.211.242.84"},"Url:/":{"type":"Url","value":"/"}},"chains":[{"id":"1542538483945732179","root":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus","likely malicious file"]}},{"id":"1542538471442511629","root":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","edges":[{"edge_kind":"contacted_domain","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Domain:6e4a44da8a6499f33a358e25d0a7da77e0e0738b72ce7bf1eb09739e64b1dc46"}],"verdict":{"verdict":"unknown"}},{"id":"1542538461812445971","root":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"File:2cf54dd36af7a64ea55fb2c66090fb525751e5e05ecac336ca8876d9d2b5a88e"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","edges":[{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:176.56.184.37"},{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:209.239.123.75"},{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:188.42.129.148"},{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:136.243.104.235"},{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:95.211.242.83"},{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:95.211.242.84"},{"edge_kind":"contacted_ip","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Ip:136.243.104.242"},{"edge_kind":"contacted_domain","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Domain:6e4a44da8a6499f33a358e25d0a7da77e0e0738b72ce7bf1eb09739e64b1dc46"},{"edge_kind":"contacted_url","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","edges":[{"edge_kind":"extracted","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"File:2cf54dd36af7a64ea55fb2c66090fb525751e5e05ecac336ca8876d9d2b5a88e"},{"edge_kind":"extracted","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"File:91456221184bf9803754805cdd964051de3cb27455a4d12b56ddda9028a39e82"},{"edge_kind":"extracted","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"File:5f57ed1a89d94f7068d1e7fa6d284ec1d03fb806bc8d146e426c9da1c933d3b5"},{"edge_kind":"extracted","from_key":"File:1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","to_key":"File:a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":86,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":21,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":24,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ammyy","ammyyadmin","banker","emotet","rootkit","wanacrypt0r","wannacry","wcry","Win32"],"sample_flags":["Network Traffic","Extracted Files","User Comment","Multi-Process"],"sandbox_reports":[{"id":"66cc34da2f0769f9060776f2","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","LUX"],"submit_name":"AA_v3.5.exe","analysis_start_time":"2024-08-26T07:55:06+00:00","indicators_count":{"informative":175,"suspicious":36,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"66cc34b250b39467a50bbdb5","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"AA_v3.5.exe","analysis_start_time":"2024-08-26T07:54:26+00:00","indicators_count":{"informative":165,"suspicious":47,"malicious":7},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"66cc302635ab808bb20dde48","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","LUX"],"submit_name":"AA_v3.5.exe","analysis_start_time":"2024-08-26T07:35:02+00:00","indicators_count":{"informative":171,"suspicious":36,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5ad92b2b7ca3e13f0e607923","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RemoteAdmin.Ammyy","contacted_countries":["NLD"],"submit_name":"AA_v3.exe","analysis_start_time":"2018-04-20T00:49:08+00:00","indicators_count":{"informative":16,"suspicious":20,"malicious":10},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"57458e65aac2edca70f9e5b4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RemoteAdmin.Ammyy","contacted_countries":["NLD"],"submit_name":"AA_v3.exe","analysis_start_time":"2018-03-05T09:00:58+00:00","indicators_count":{"informative":15,"suspicious":18,"malicious":10},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5728aee5aac2ed4e5716e099","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RemoteAdmin.Ammyy","contacted_countries":["NLD","USA"],"submit_name":"AA_v3 (1).exe","analysis_start_time":"2016-05-03T10:02:18+00:00","indicators_count":{"informative":8,"suspicious":22,"malicious":11},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"566940f00e316d157a28bf97","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Riskware.RemoteAdmin","contacted_countries":["USA"],"submit_name":"AA_v3.exe","analysis_start_time":"2015-12-10T03:08:47+00:00","indicators_count":{"informative":8,"suspicious":22,"malicious":5},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":false},{"id":"55cb08af0e316d6f0aaca043","environment_id":5,"environment_description":"W7 32 bit 'Stealthy Mode' with 'DNS Spoof'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Riskware.RemoteAdmin","contacted_countries":["USA","VGB"],"submit_name":"AA_v3.exe","analysis_start_time":"2015-08-12T03:51:04+00:00","indicators_count":{"informative":7,"suspicious":21,"malicious":8},"tags":["Network Traffic","Extracted Files","User Comment","Simulated analysis"],"is_in_unified_schema":false},{"id":"557846708690b8fb686bbb51","environment_id":1,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"Riskware.RemoteAdmin","contacted_countries":["NLD","VGB"],"submit_name":"98154388263-107-0_AA_v3.exe_1.AA_v3.exe","analysis_start_time":"2015-06-10T16:16:21+00:00","indicators_count":{"informative":9,"suspicious":23,"malicious":9},"tags":["Network Traffic","Extracted Files","Sample not shared","User Comment"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"176.56.184.37","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"address":"209.239.123.75","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"address":"188.42.129.148","port":80,"protocol":"TCP","country":"Luxembourg","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"address":"136.243.104.235","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"address":"95.211.242.83","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"address":"95.211.242.84","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"address":"136.243.104.242","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"dns_resolutions":[{"domain":"rl.ammyy.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"http_requests":[{"host":"rl.ammyy.com","host_ip":"176.56.184.37:80","url":"/","method":"POST","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"embedded_domains":[{"value":"rl.ammyy.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}],"processes":[{"pid":7512,"ppid":0,"name":"AA_v3.5.exe","command_line":"","sha256":"1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","normalized_path":"C:\\AA_v3.5.exe","uid":"00000000-00007512","icon":"$3e"},{"pid":7760,"ppid":0,"name":"AA_v3.5.exe","command_line":"-service -lunch","sha256":"1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","normalized_path":"C:\\AA_v3.5.exe","uid":"00000000-00007760","icon":"$3f"},{"pid":5096,"ppid":7760,"name":"AA_v3.5.exe","command_line":"","sha256":"1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed","normalized_path":"C:\\AA_v3.5.exe","parent_uid":"00000000-00007760","uid":"00000000-00005096"}],"all_imported_dlls":["gdi32.dll","user32.dll","wintrust.dll","sechost.dll","ntdll.dll","sspicli.dll","lpk.dll","winmm.dll","Wldap32.dll","oleaut32.dll","powrprof.dll","ntmarta.dll","ws2_32.dll","rpcrt4.dll","IPHLPAPI.DLL","urlmon.dll","advapi32.dll","nsi.dll","shell32.dll","shlwapi.dll","KernelBase.dll","ole32.dll","comdlg32.dll","comctl32.dll","userenv.dll","imm32.dll","secur32.dll","setupapi.dll","profapi.dll","msasn1.dll","msctf.dll","devobj.dll","winnsi.dll","iertutil.dll","usp10.dll","kernel32.dll","msvcrt.dll","msvcp60.dll","wininet.dll","crypt32.dll","cfgmgr32.dll","dsound.dll","dhcpcsvc.dll","FWPUCLNT.DLL","kernel.appcore.dll","WinTypes.dll","wow64cpu.dll","ucrtbase.dll","windows.storage.dll","uxtheme.dll","mswsock.dll","wow64.dll","bcryptprimitives.dll","VxSSL32.dll","combase.dll","TextInputFramework.dll","rasadhlp.dll","bcrypt.dll","winmmbase.dll","cryptbase.dll","dwmapi.dll","wow64win.dll","gdi32full.dll","winhttp.dll","dnsapi.dll","CoreUIComponents.dll","msvcp_win.dll","SHCore.dll","win32u.dll","CoreMessaging.dll","OnDemandConnRouteHelper.dll","fltLib.dll","apphelp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","version.dll","normaliz.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","RESAMPLEDMO.DLL","TextShaping.dll","msdmo.dll","wow64base.dll","umpdc.dll","wow64con.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"2cf54dd36af7a64ea55fb2c66090fb525751e5e05ecac336ca8876d9d2b5a88e","sha256":"2cf54dd36af7a64ea55fb2c66090fb525751e5e05ecac336ca8876d9d2b5a88e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"hr","sha256":"91456221184bf9803754805cdd964051de3cb27455a4d12b56ddda9028a39e82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"hr3","sha256":"5f57ed1a89d94f7068d1e7fa6d284ec1d03fb806bc8d146e426c9da1c933d3b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"settings3.bin","sha256":"a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"path":"%ALLUSERSPROFILE%\\AMMYY\\hr","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"path":"{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"path":"%ALLUSERSPROFILE%\\AMMYY\\settings3.bin","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"path":"PhysicalDrive0","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"path":"%ALLUSERSPROFILE%\\AMMYY\\hr3","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"path":"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"path":"%ALLUSERSPROFILE%\\AMMYY","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\AMMYY\\ADMIN\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKCU\\SOFTWARE\\AMMYY\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"},{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKLM\\SOFTWARE\\AMMYY\\ADMIN\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"key":"HKLM\\SOFTWARE\\AMMYY\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"},{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_F40\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"key":"HKCUHKCU\\SOFTWARE\\AMMYY\\ADMIN\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"key":"HKCUHKCU\\SOFTWARE\\AMMYY\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\AMMYY\\ADMIN\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\AMMYY\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"},{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_9C4\\","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\AMMYY\\ADMIN\\","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\AMMYY\\","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_F14\\","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_F40\\","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_9C4\\","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SAFEBOOT\\NETWORK\\AMMYYADMIN_F14\\","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x00000F40)","sources":[{"report_type":"sandbox","report_id":"5728aee5aac2ed4e5716e099"}]},{"name":"SM0:5096:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"name":"Local\\SM0:5096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66cc302635ab808bb20dde48"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x000009C4)","sources":[{"report_type":"sandbox","report_id":"57458e65aac2edca70f9e5b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x00000F14)","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"name":"Local\\DirectSound DllMain mutex (0x00000F14)","sources":[{"report_type":"sandbox","report_id":"5ad92b2b7ca3e13f0e607923"}]},{"name":"Local\\SM0:7892:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]},{"name":"SM0:7892:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66cc34da2f0769f9060776f2"}]}]}},"report_ids":{"sandbox_job_ids":["5ad92b2b7ca3e13f0e607923","66cc34da2f0769f9060776f2","66cc302635ab808bb20dde48","57458e65aac2edca70f9e5b4","5728aee5aac2ed4e5716e099"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/grayware_confidence_100% Sample 1831806fc27d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1831806fc27d…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_100% Sample 1831806fc27d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1831806fc27d…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_100% Sample 1831806fc27d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1831806fc27d…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 15/27 AV engines flagged this file. 14 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L40","11",{}]]