24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 190799d08ea8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 190799d08ea8…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8"],"about":{"@type":"SoftwareApplication","name":"19079.Trojan.exe","applicationCategory":["peexe","executable"],"identifier":"190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T630,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "19079.Trojan.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "19079.Trojan.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "19079.Trojan.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp")26:T859,Assembly shows XOR instruction xor eax ebp in Stream UID: 38699-298-0040B238 Assembly shows XOR instruction xor esi ecx in Stream UID: 38699-298-0040B238 Assembly shows XOR instruction xor ebx ecx in Stream UID: 38699-298-0040B238 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38699-298-0040B238 Assembly shows XOR instruction xor eax ebp in Stream UID: 38699-88-00406740 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38699-88-00406740 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-90-0040C8CB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-90-0040C8CB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-86-0040964F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-86-0040964F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-96-00409A39 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-96-00409A39 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-82-004069F3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-82-004069F3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-84-00406740 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-84-00406740 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-87-0040C914 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-87-0040C914 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008096-41760-16-004070C4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008096-41760-16-004070C4 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00008096-41760-133-004065DC Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00008096-41760-133-004065DC Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00008096-41760-133-004065DC27:T9f6,".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000d3e6dccd23258d73f01fde00687d6d7490eede0030548d737f0a8dbefeffffffacedde00b2408c7350edde000000337448eede00cb408c73e0df147408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000d8edde000000000008000000000000000000000000000000000000000000000000003374bbe6dccd0000000018eede006992ca74ffffffff34000000d8edde0008000000000000000000337448eede002794ca74e0edde000b0000000000000030eede00 (UID: 00000000-00008096) ".exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008096) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008096) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000189c0e05bc9b0e05226e3a7400002703000000002d6e3a74475362392d000000ecb76275409c0e0500000203705e2a0380372a031400000080000000809b0e0500000203049c0e0570c83b7403b92c48feffffff2d000000d0cc717527000000d49b0e05856a3c741c234174149c0e05f85f3c7408000000bb693b74b2693b74ef5462392d000000ecb7627527000000d0cc7175e89b0e052d000000d0cc717527000000189c0e05856a3c741c234174609c0e057e8a7075ee8c7075738a70753f345e202d000000ecb7627527000000d0cc7175dc262703702627033f345e20289c0e05fc52ae75149d0e05e08470756759fc50feffffff738a7075 (UID: 00000000-00008096)28:T7ef,".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "27AC9369FAF25207BB2627CEFACCBE4EF9C319B8") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "27AC9369FAF25207BB2627CEFACCBE4EF9C319B8") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "27AC9369FAF25207BB2627CEFACCBE4EF9C319B8") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "27AC9369FAF25207BB2627CEFACCBE4EF9C319B8") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "340B2880F446FCC04E59ED33F52B3D08D6242964") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "340B2880F446FCC04E59ED33F52B3D08D6242964") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "340B2880F446FCC04E59ED33F52B3D08D6242964") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "340B2880F446FCC04E59ED33F52B3D08D6242964") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "2796BAE63F1801E277261BA0D77770028F20EEE4") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "2796BAE63F1801E277261BA0D77770028F20EEE4")29:T886,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter NETAPI32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter BCRYPT.DLL (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter CRYPT32.DLL (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00008096) ".exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00008096)2a:T6de3,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter EnumSystemLocalesA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetHandleCount (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FatalAppExitA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter NetWkstaGetInfo (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter TzSpecificLocalTimeToSystemTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter LocalFileTimeToFileTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetCurrentHwProfileA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetFileSecurityA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter DuplicateToken (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter MapGenericMask (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter AccessCheck (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HttpAddRequestHeadersA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetSetFilePointer (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter DeleteUrlCacheEntry (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GetModuleBaseNameA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SHFileOperationA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter PathMatchSpecW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter PathFindFileNameA (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter SymMatchString (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00008096) ".exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00008096)2b:T8bfd,Found reference to API (Indicator: "EncodePointer"; File: "19079.Trojan.bin") Found reference to API (Indicator: "DecodePointer"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FlsFree"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FlsSetValue"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FlsGetValue"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FlsAlloc"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "19079.Trojan.bin") Found reference to API (Indicator: "MessageBoxA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetNumberFormatA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "Sleep"; File: "19079.Trojan.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "19079.Trojan.bin") Found reference to API (Indicator: "CreateThread"; File: "19079.Trojan.bin") Found reference to API (Indicator: "lstrlenW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "VirtualProtect"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetProcAddress"; File: "19079.Trojan.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "19079.Trojan.bin") Found reference to API (Indicator: "LockResource"; File: "19079.Trojan.bin") Found reference to API (Indicator: "LoadResource"; File: "19079.Trojan.bin") Found reference to API (Indicator: "SizeofResource"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FindResourceW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetLastError"; File: "19079.Trojan.bin") Found reference to API (Indicator: "CreateMutexA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "TlsFree"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FreeConsole"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "19079.Trojan.bin") Found reference to API (Indicator: "ExitProcess"; File: "19079.Trojan.bin") Found reference to API (Indicator: "WriteFile"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetStdHandle"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "19079.Trojan.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "SetHandleCount"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetFileType"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "19079.Trojan.bin") Found reference to API (Indicator: "TlsGetValue"; File: "19079.Trojan.bin") Found reference to API (Indicator: "TlsAlloc"; File: "19079.Trojan.bin") Found reference to API (Indicator: "TlsSetValue"; File: "19079.Trojan.bin") Found reference to API (Indicator: "InterlockedIncrement"; File: "19079.Trojan.bin") Found reference to API (Indicator: "SetLastError"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "19079.Trojan.bin") Found reference to API (Indicator: "InterlockedDecrement"; File: "19079.Trojan.bin") Found reference to API (Indicator: "HeapCreate"; File: "19079.Trojan.bin") Found reference to API (Indicator: "VirtualFree"; File: "19079.Trojan.bin") Found reference to API (Indicator: "HeapFree"; File: "19079.Trojan.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetTickCount"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetCPInfo"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetACP"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetOEMCP"; File: "19079.Trojan.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "19079.Trojan.bin") Found reference to API (Indicator: "TerminateProcess"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "19079.Trojan.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "19079.Trojan.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "19079.Trojan.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "19079.Trojan.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "19079.Trojan.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "19079.Trojan.bin") Found reference to API (Indicator: "HeapAlloc"; File: "19079.Trojan.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "19079.Trojan.bin") Found reference to API (Indicator: "RtlUnwind"; File: "19079.Trojan.bin") Found reference to API (Indicator: "LCMapStringA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "19079.Trojan.bin") Found reference to API (Indicator: "LCMapStringW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetStringTypeA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "19079.Trojan.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "19079.Trojan.bin") Found reference to API (Indicator: "HeapSize"; File: "19079.Trojan.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "19079.Trojan.bin") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "NetWkstaGetInfo"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FatalAppExitA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp")2c:T58a,"\REGISTRY\MACHINE\SOFTWARE\Microsoft\Win" in Source: 00000000-00008096.00000000.73899.00CE8000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "Software\Micr" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00008096.00000000.73899.03090000.00000004.mdmp2d:Td01,".exe" loaded module "KERNEL32" at base 76c20000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74ba0000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74ba0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74ba0000 ".exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 76940000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74ba0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74ba0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74ba0000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73810000 ".exe" loaded module "KERNEL32.DLL" at base 76c20000 ".exe" loaded module "USER32.DLL" at base 75380000 ".exe" loaded module "GDI32.DLL" at base 74330000 ".exe" loaded module "OLE32.DLL" at base 749a0000 ".exe" loaded module "OLEAUT32.DLL" at base 74de0000 ".exe" loaded module "NETAPI32.DLL" at base 737f0000 ".exe" loaded module "ADVAPI32.DLL" at base 74e80000 ".exe" loaded module "BCRYPT.DLL" at base 726e0000 ".exe" loaded module "CRYPT32.DLL" at base 76d00000 ".exe" loaded module "WININET.DLL" at base 723c0000 ".exe" loaded module "PSAPI.DLL" at base 73f10000 ".exe" loaded module "SHELL32.DLL" at base 75600000 ".exe" loaded module "SHLWAPI.DLL" at base 75330000 ".exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76c20000 ".exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 74ba0000 ".exe" loaded module "DBGHELP.DLL" at base 72230000 ".exe" loaded module "GDIPLUS.DLL" at base 73c20000 ".exe" loaded module "RPCRT4.DLL" at base 76970000 ".exe" loaded module "SSPICLI.DLL" at base 73ef0000 ".exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72210000 ".exe" loaded module "WINHTTP.DLL" at base 72160000 ".exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72210000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73900000 ".exe" loaded module "MSISO.DLL" at base 71f60000 ".exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71f50000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71f00000 ".exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75590000 ".exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 71e90000 ".exe" loaded module "MSKEYPROTECT.DLL" at base 71e80000 ".exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 742d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71dd0000 ".exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71da0000 ".exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 71da0000 ".exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 76c200002e:T6d6,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2f:Tadc,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "19079.TROJAN.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")30:T542,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\NETAPI32.DLL" ".exe" trying to access non-existent file "C:\NETAPI32.dll" ".exe" trying to access non-existent file "C:\SAMCLI.DLL" ".exe" trying to access non-existent file "C:\NETUTILS.DLL" ".exe" trying to access non-existent file "C:\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\WININET.DLL" ".exe" trying to access non-existent file "C:\wininet.dll" ".exe" trying to access non-existent file "C:\DBGHELP.DLL" ".exe" trying to access non-existent file "C:\dbghelp.dll" ".exe" trying to access non-existent file "C:\IERTUTIL.DLL" ".exe" trying to access non-existent file "C:\iertutil.dll" ".exe" trying to access non-existent file "C:\URLMON.DLL" ".exe" trying to access non-existent file "C:\urlmon.dll" ".exe" trying to access non-existent file "C:\DPAPI.DLL" ".exe" trying to access non-existent file "C:\CRYPTSP.DLL" ".exe" trying to access non-existent file "C:\CRYPTSP.dll"31:T7e9,Found URL "https://t.me/tatlimarkpast4forum.zipmozilla/5.0" - Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199536605936helloupdate.zipopenopen_null%s\*c:\\\windows\c:\\windows\c:\windows\*.lnkhttp://threads:" - Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp") Found URL "https://freebl3.dllmozglue.dllmsvcp140.dllnss3.dllsoftokn3.dllvcruntime140.dll.exe%s\%s\%s\%s%s\%s\%s%s\%s\*\wallets\chia" - Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/oftware\policies\microsoft\systemcertificates\rootdomain" - Source: "00000000-00008096.00000000.73899.03280000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/oftware\policies\microsoft\systemcertificates\rootoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00008096.00000000.73899.03280000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/http://crl.godaddy.com/gdroot.crlc:\windows\syswow64\inetcomm.dllrl" - Source: "00000000-00008096.00000000.73899.03280000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008096.00000000.73899.03280000.00000004.mdmp") Found URL "https://t.me/tatlimarkpast4forum.zipmozilla/5.0" - Source: "00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found URL "https://steamcommunity.com/profiles/76561199536605936helloupdate.zipopenopen_null%s\*c:\\\windows\c:\\windows\c:\windows\*.lnkhttp://threads:" - Source: "00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found URL "https://freebl3.dllmozglue.dllmsvcp140.dllnss3.dllsoftokn3.dllvcruntime140.dll.exe%s\%s\%s\%s%s\%s\%s%s\%s\*\wallets\chia" - Source: "00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found URL "https://t.me/tatlimarkhttps://t.me/tatlimark5.0" - Source: "00000000-00008096.00000000.73899.052B0000.00000004.mdmp") Found URL "https://t.me/tatlimarkfalsetrue" - Source: "00000000-00008096.00000000.73899.052B0000.00000004.mdmp")32:Tb22,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "19079.Trojan.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "19079.Trojan.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "19079.Trojan.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "19079.Trojan.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "19079.Trojan.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "19079.Trojan.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp")33:T431,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "19079.Trojan.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "19079.Trojan.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp")34:T444,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "19079.Trojan.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "19079.Trojan.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "19079.Trojan.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp")35:Ta2d,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")36:T101a,".exe" wrote bytes "40d2f273300df373e0f6f273c0cdf273" to virtual address "0x774616C4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "00c70077e0a00d77" to virtual address "0x737CA134" (part of module "IERTUTIL.DLL") ".exe" wrote bytes "d03e5a7530755975f0815a75404f597520ec597500825a75d07f5a75901b5a7530535a75005e597580f85975f0f15975" to virtual address "0x721FD154" (part of module "WINHTTP.DLL") ".exe" wrote bytes "3014ef766015ef76101eef76a013ef767013ef769026ef76d014ef76701bef76b01cef76f017ef76" to virtual address "0x73E3C028" (part of module "IPHLPAPI.DLL") ".exe" wrote bytes "70da3875b0a83975" to virtual address "0x74D4E2D8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "b051f373202ff3734051f373804ff373" to virtual address "0x721FD1D0" (part of module "WINHTTP.DLL") ".exe" wrote bytes "30ccc77440e1c674" to virtual address "0x71FB70E8" (part of module "MSISO.DLL") ".exe" wrote bytes "00165474b0ff4d74b0f04c74b007517450b64d7480044d7440f64c74a01b5174e0b64d7490415374f061507450bc4d74606e4d74409e4c7420234a7470245274106e4d7400914b74003d5374" to virtual address "0x726572F0" (part of module "WININET.DLL") ".exe" wrote bytes "90415374b0075174b0f04c74106e4d74b0ff4d74606e4d74" to virtual address "0x721FD188" (part of module "WINHTTP.DLL") ".exe" wrote bytes "c0daef73" to virtual address "0x720E8094" (part of module "URLMON.DLL") ".exe" wrote bytes "e0a7df746036df7470a8df7420a9df7410a3df740042df74b08adf742035df74c01be074" to virtual address "0x720E8054" (part of module "URLMON.DLL") ".exe" wrote bytes "50c3ca7420e6d17410b2ca7480bbca74a0e7c77400b6ca74109fca746080ca74d096ca743090ca7450bac87400c8ca7460b8ca7410bdca740078ca7440ceca7450bbca74709fca7440d8c8743089ca74a09fca7480a7ca74309dca74" to virtual address "0x726573B8" (part of module "WININET.DLL") ".exe" wrote bytes "c047fe712060097220be0172" to virtual address "0x72657538" (part of module "WININET.DLL") ".exe" wrote bytes "300df373" to virtual address "0x72657440" (part of module "WININET.DLL") ".exe" wrote bytes "80ed7673904e767390877773d05c77732046797340067773709e7a73a0ec767350637773705f7773206e777350c376732016777370687673e0d2767310d37673a0d27673407e7773e0e776730055767350837773f0187773" to virtual address "0x726574CC" (part of module "WININET.DLL") ".exe" wrote bytes "a0921d02b0921d02b017010080f00600c0020100b0f0060060b20600e0911d02f0911d02" to virtual address "0x753FAC94" (part of module "USER32.DLL") ".exe" wrote bytes "309f7874f0667b74702a777420a4787470237774003b787410607874b05b787400b07874805b7874d0817874d00d7674" to virtual address "0x7434E018" (part of module "GDI32.DLL") ".exe" wrote bytes "00052874809e2774" to virtual address "0x72657448" (part of module "WININET.DLL") ".exe" wrote bytes "90353274103b32740036327470373274" to virtual address "0x737CA0CC" (part of module "IERTUTIL.DLL") ".exe" wrote bytes "70a8df7420a9df746036df74c01be0742036df74c037df744035df74d0d7df740059e474f08cdf74e0a7df74" to virtual address "0x737CA04C" (part of module "IERTUTIL.DLL") ".exe" wrote bytes "10883975" to virtual address "0x72657494" (part of module "WININET.DLL") ".exe" wrote bytes "1041f373" to virtual address "0x721FD1EC" (part of module "WINHTTP.DLL") ".exe" wrote bytes "8052f073c044f0738049f073905bf073e050f073e05cf0731049f073f0c6ef738092ef73f044f073408eef73a0b0ef73a056f073c0dbef73705cf0739075f0735074f0733057f073c049f073a055f073" to virtual address "0x726571D0" (part of module "WININET.DLL") ".exe" wrote bytes "0057e173e054e173e05ae17380aee173a06de1730058e173" to virtual address "0x72657110" (part of module "WININET.DLL") ".exe" wrote bytes "d04f6074f0c24a7490c6537400cb4a74f0f3527440dd527460ef5274102d4b7480a64a7420be517470425374a0be5174c0ff4a7440bf5174e0585374" to virtual address "0x774615B0" (part of module "WINDOWS.STORAGE.DLL")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790490835797,"unified_at":"2026-09-27T06:33:55.797Z","metadata":{"hashes":{"sha256":"190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8","sha1":"2d8570c5c7429ea993e3f54723480ad3596a1efd","md5":"607e6ab52c0ca1b20e60130ac9288c57","sha512":"da7f9f42c56572b8085980c82d4ea40d2057f41d5d48af6478773296af06a765e4dd7a26ccb374d926bf029ce4469091773f5d859bbf562770c603083e68887b","ssdeep":"12288:89zqCMsFnpxyq5+/z+p/tIpVEOPUOKY5M9VuspJrnmcDhF7fsB:4zqGrxyogynLJY0PpVmcDhF7fs","ssdeep_chunks":["12288:89zqCMs","12288:9zqCMsF","12288:zqCMsFn","12288:qCMsFnp","12288:CMsFnpx","12288:MsFnpxy","12288:sFnpxyq","12288:Fnpxyq5","12288:npxyq5+","12288:pxyq5+/","12288:xyq5+/z","12288:yq5+/z+","12288:q5+/z+p","12288:5+/z+p/","12288:+/z+p/t","12288:/z+p/tI","12288:z+p/tIp","12288:+p/tIpV","12288:p/tIpVE","12288:/tIpVEO","12288:tIpVEOP","12288:IpVEOPU","12288:pVEOPUO","12288:VEOPUOK","12288:EOPUOKY","12288:OPUOKY5","12288:PUOKY5M","12288:UOKY5M9","12288:OKY5M9V","12288:KY5M9Vu","12288:Y5M9Vus","12288:5M9Vusp","12288:M9VuspJ","12288:9VuspJr","12288:VuspJrn","12288:uspJrnm","12288:spJrnmc","12288:pJrnmcD","12288:JrnmcDh","12288:rnmcDhF","12288:nmcDhF7","12288:mcDhF7f","12288:cDhF7fs","12288:DhF7fsB","24576:89zqCMs","24576:9zqCMsF","24576:zqCMsFn","24576:qCMsFnp","24576:CMsFnpx","24576:MsFnpxy","24576:sFnpxyq","24576:Fnpxyq5","24576:npxyq5+","24576:pxyq5+/","24576:xyq5+/z","24576:yq5+/z+","24576:q5+/z+p","24576:5+/z+p/","24576:+/z+p/t","24576:/z+p/tI","24576:z+p/tIp","24576:+p/tIpV","24576:p/tIpVE","24576:/tIpVEO","24576:tIpVEOP","24576:IpVEOPU","24576:pVEOPUO","24576:VEOPUOK","24576:EOPUOKY","24576:OPUOKY5","24576:PUOKY5M","24576:UOKY5M9","24576:OKY5M9V","24576:KY5M9Vu","24576:Y5M9Vus","24576:5M9Vusp","24576:M9VuspJ","24576:9VuspJr","24576:VuspJrn","24576:uspJrnm","24576:spJrnmc","24576:pJrnmcD","24576:JrnmcDh","24576:rnmcDhF","24576:nmcDhF7","24576:mcDhF7f","24576:cDhF7fs","24576:DhF7fsB","12288:4zqGrxy","12288:zqGrxyo","12288:qGrxyog","12288:Grxyogy","12288:rxyogyn","12288:xyogynL","12288:yogynLJ","12288:ogynLJY","12288:gynLJY0","12288:ynLJY0P","12288:nLJY0Pp","12288:LJY0PpV","12288:JY0PpVm","12288:Y0PpVmc","12288:0PpVmcD","12288:PpVmcDh","12288:pVmcDhF","12288:VmcDhF7"],"imphash":"9a7926a13a446b4e7cb403f27d8472ca"},"file_info":{"file_name":"19079.Trojan.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":547328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1691825715000,"last_seen":1691825715000,"last_multi_scan":1691825715000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","informationstealer","vidarstealer","evasive"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":119,"suspicious_count":15,"malicious_count":3,"total":137},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.RedLine","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.68629610","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.68629610 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenKryptik.GGPO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Amadey.m","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059f7f31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.Win32.Stealerc.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.IMKH-1297","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to convert data from binary to string"},{"type":"suspicious","value":"YARA signature match - CRC-32 algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceW\" with parameter \"2\" - (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4268232'}\" (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"19079.Trojan.bin\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"19079.Trojan.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"!\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\"), Found string \"!\"#$%&'()*+\n-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp\n 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008096.00000000.73899.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008096.00000000.73899.04EA0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"19079.Trojan.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"19079.Trojan.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"19079.Trojan.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"19079.Trojan.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"19079.Trojan.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00008096-41760-17-00407BF4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00008096-41760-16-004070C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"8096\" - (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00008096-41760-133-004065DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008096-41760-133-004065DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00008096-41760-133-004065DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00008096-41760-90-0040C8CB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"19079.Trojan.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp\n 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-351","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00008096-00000C15-29487108","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00008096-00000C15-29487108","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"340B2880F446FCC04E59ED33F52B3D08D6242964\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"340B2880F446FCC04E59ED33F52B3D08D6242964\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"19079.Trojan.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * From Win32_OperatingSystem\" (Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp, Indicator: \"select * from win32_operatingsystem\")\n \"Select * From AntiVirusProduct\" (Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00008096-41760-52-004088CE\n WaitForSingleObject@KERNEL32.DLL at 00000000-00008096-41760-135-004013C0\n Sleep@KERNEL32.DLL at 00000000-00008096-41760-36-00408913\n Sleep@KERNEL32.DLL at 00000000-00008096-41760-69-0040895F\n Sleep@KERNEL32.DLL at 00000000-00008096-41760-10-00405091","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 19079.Trojan.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00008096-41760-135-004013C0\n LoadLibraryA@KERNEL32.DLL at 00000000-00008096-41760-13-00408563","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"19079.Trojan.bin\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"19079.Trojan.bin\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"19079.Trojan.bin\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"19079.Trojan.bin\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"19079.Trojan.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"19079.Trojan.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:8096:168:WilStaging_02\"\n \"vJQROBJOEJTIEVJRIQN\"\n \"SM0:8096:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:8096:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00008096-00000C7C-4710771088\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74D80000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 726E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76970000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"19079.Trojan.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"19079.Trojan.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"19079.Trojan.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"19079.Trojan.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"19079.Trojan.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"19079.Trojan.bin\" file has an entrypoint instructions - \"call\t0x4065dc,jmp\t0x4040a7,push\tebp,mov\tebp, esp,sub\tesp, 8,mov\tdword ptr [ebp - 4], edi,mov\tdword ptr [ebp - 8], esi,mov\tesi, dword ptr [ebp + 0xc],mov\tedi, dword ptr [ebp + 8],mov\tecx, dword ptr [ebp + 0x10],shr\tecx, 7,jmp\t0x404223,lea\tebx, [ebx],movdqa\txmm0, xmmword ptr [esi],movdqa\txmm1, xmmword ptr [esi + 0x10],movdqa\txmm2, xmmword ptr [esi + 0x20],movdqa\txmm3, xmmword ptr [esi + 0x30],movdqa\txmmword ptr [edi], xmm0,movdqa\txmmword ptr [edi + 0x10], xmm1,movdqa\txmmword ptr [edi + 0x20], xmm2,movdqa\txmmword ptr [edi + 0x30], xmm3,movdqa\txmm4, xmmword ptr [esi + 0x40],movdqa\txmm5, xmmword ptr [esi + 0x50],movdqa\txmm6, xmmword ptr [esi + 0x60],movdqa\txmm7, xmmword ptr [esi + 0x70],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 8096 -ip 8096\" (UID: 00000000-00007912)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8096 -s 1372\" (UID: 00000000-00005888)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8096 -s 1372\" (UID: 00000000-00004980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 444 -p 8096 -ip 8096\" (UID: 00000000-00007912)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8096 -s 1372\" (UID: 00000000-00005888)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8096 -s 1372\" (UID: 00000000-00004980)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"19079.Trojan.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"19079.Trojan.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\19079.Trojan.exe\" (UID: 8096)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\".exe\" called \"NtQueueApcThread\" (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \".exe\" trying to touch file \"C:\\19079.Trojan.exe\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \".exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \".exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\19079.TROJAN.EXE.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\19079.Trojan.exe.Local\\\"\n \".exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\".exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /tatlimark\" - (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\".exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0\" (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00008096-00000C26-29483663\")\n Found reference to API \"HttpSendRequestA\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00008096-00000C26-29483722\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00008096-00000C26-29483772\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00008096-00000C26-29483830\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008096-00000C26-29483880\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; Source: \"00000000-00008096-00000C26-29484000\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00008096-00000C26-29484136\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp\n 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"|l.bd\"\n Heuristic match: \"_|l.ee\"\n Heuristic match: \"|X.cd\"\n Heuristic match: \"4)29/.Lb\"\n Pattern match: \"https://t.me/tatlimark\"\n Pattern match: \"https://steamcommunity.com/profiles/76561199536605936\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00008096\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\".exe\" called \"GetComputerNameA\" (UID: 00000000-00008096)\n \".exe\" called \"GetComputerNameW\" (UID: 00000000-00008096)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"19079.Trojan.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00008096.00000000.73899.00D05000.00000004.mdmp\n 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 19079.Trojan.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\19079.Trojan.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00008096.00000000.73899.00CE8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"19079.Trojan.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp, 00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.03280000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"19079.Trojan.bin\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00008096.00000000.73899.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"19079.Trojan.bin\" was detected as \"Visual C++ 2008 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00008096-00000C25-29436400\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\".exe queries ProcessDebugPort (UID: 8096)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to convert data from binary to string","description":"\".exe\" called \"CryptBinaryToStringA\" with parameters {\"pbBinary\": \"0D0B0@0>0<0\"\n \"cbBinary\": \"70\"\n \"dwFlags\": \"1\"\n \"pcchString\": \"63000000\"}\n \".exe\" called \"CryptBinaryToStringW\" with parameters {\"pbBinary\": \"0D0B0@0>0<0\"\n \"cbBinary\": \"70\"\n \"dwFlags\": \"1\"\n \"pcchString\": \"63000000\"}\n \".exe\" called \"CryptBinaryToStringA\" with parameters {\"pbBinary\": \"0D0B0@0>0<0\"\n \"cbBinary\": \"70\"\n \"dwFlags\": \"1\"\n \"pszString\": \"MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ==\"\n \"pcchString\": \"62000000\"}\n \".exe\" called \"CryptBinaryToStringW\" with parameters {\"pbBinary\": \"0D0B0@0>0<0\"\n \"cbBinary\": \"70\"\n \"dwFlags\": \"1\"\n \"pszString\": \"MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ==\"\n \"pcchString\": \"62000000\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-230","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-120-00406228\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-32-00405F7F\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-135-004013C0\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-9-00405E93\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-14-00405E18\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-10-00405091\n GetModuleHandleW@KERNEL32.DLL at 00000000-00008096-41760-56-004050EA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00008096-41760-117-00405B78","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * From Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/71 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00008096-41760-135-004013C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - CRC-32 algorithm","description":"YARA signature for CRC-32 algorithm matched on process \"00000000-00008096\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-111","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00008096.00000000.73899.00D05000.00000004.mdmp, 00000000-00008096.00000000.73899.04EFC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n LockResource\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n CreateThread\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n FindResourceW\n Sleep\n GetTickCount\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$36","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/71 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","informationstealer","vidarstealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"64d8196321097896d508d35c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["GBR"],"submit_name":"19079.Trojan.exe","analysis_start_time":"2023-08-12T23:44:35+00:00","indicators_count":{"informative":119,"suspicious":34,"malicious":3},"tags":["Multi-Process","Network Traffic","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}],"dns_resolutions":[{"domain":"t.me","address":"149.154.167.99","ttl":44,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}],"processes":[{"pid":8096,"ppid":0,"name":"19079.Trojan.exe","command_line":"","sha256":"190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8","normalized_path":"C:\\19079.Trojan.exe","uid":"00000000-00008096","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5888,"ppid":8096,"name":"WerFault.exe","command_line":"-u -p 8096 -s 1372","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008096","uid":"00000000-00005888"},{"pid":4980,"ppid":8096,"name":"WerFault.exe","command_line":"-u -p 8096 -s 1372","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008096","uid":"00000000-00004980"},{"pid":7912,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 8096 -ip 8096","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007912","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["rpcrt4.dll","win32u.dll","windows.storage.dll","kernel.appcore.dll","dbghelp.dll","winnsi.dll","ntdll.dll","user32.dll","gdi32.dll","shlwapi.dll","schannel.dll","dpapi.dll","kernel32.dll","cryptbase.dll","msvcrt.dll","combase.dll","SHCore.dll","iertutil.dll","rasadhlp.dll","cryptnet.dll","wow64win.dll","imm32.dll","netapi32.dll","crypt32.dll","wininet.dll","profapi.dll","winhttp.dll","mskeyprotect.dll","VxSSL32.dll","ws2_32.dll","fltLib.dll","oleaut32.dll","psapi.dll","imagehlp.dll","cryptsp.dll","ole32.dll","msasn1.dll","shell32.dll","powrprof.dll","FWPUCLNT.DLL","mswsock.dll","sechost.dll","advapi32.dll","cfgmgr32.dll","bcryptprimitives.dll","samcli.dll","bcrypt.dll","ncrypt.dll","GdiPlus.dll","KernelBase.dll","IPHLPAPI.DLL","wow64cpu.dll","sspicli.dll","OnDemandConnRouteHelper.dll","rsaenh.dll","apphelp.dll","netutils.dll","dnsapi.dll","wintrust.dll","ucrtbase.dll","gdi32full.dll","ntasn1.dll","msvcp_win.dll","msIso.dll","urlmon.dll","nsi.dll","wow64.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:8096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"vJQROBJOEJTIEVJRIQN","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"SM0:8096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"SM0:8096:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64d8196321097896d508d35c"}]}]}},"report_ids":{"sandbox_job_ids":["64d8196321097896d508d35c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 190799d08ea8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 190799d08ea8…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 190799d08ea8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 190799d08ea8…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/190799d08ea8f5f3ff77f68c1fc6d2d231b3412c46407b9fa72bd485132de1c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 190799d08ea8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 190799d08ea8…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]