24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T512,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AIT:Trojan.Formbook.384;AIT:Trojan.Formbook Sample 1dc7d0f029aa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1dc7d0f029aa…. Malware family: AIT:Trojan.Formbook.384;AIT:Trojan.Formbook. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","keywords":["Malicious","AIT:Trojan.Formbook.384;AIT:Trojan.Formbook","malware analysis","sandbox report","threat intelligence","1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af"],"about":{"@type":"SoftwareApplication","name":"bounty-26408875152785131","applicationCategory":["peexe","autoit","executable"],"identifier":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"AIT:Trojan.Formbook.384;AIT:Trojan.Formbook","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":13,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40c,Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "WNetGetConnectionW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FtpOpenFileW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSaveFileNameW"; Source: "sample.bin")26:T652,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4957376'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4956768'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4957456'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4956408'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4957416'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4956368'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4956808'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4957496'}" (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4956448'}" (UID: 00000000-00004240)27:T84a,Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")28:Ted1,Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "RRmAesDd" (Indicator: "Aes"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")29:T694,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")2a:T12fb,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-1636-00418752 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-1636-00418752 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-1640-0042009C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-1640-0042009C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-1645-00417DAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-1645-00417DAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-1812-0041B0B5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-1812-0041B0B5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-2040-0041F814 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-2040-0041F814 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-2050-00425095 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-2050-00425095 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-2055-0041C62B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-2055-0041C62B Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 00000000-00004240-62148-2157-0041C9AE Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 00000000-00004240-62148-2157-0041C9AE Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00004240-62148-2157-0041C9AE Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00004240-62148-2157-0041C9AE Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 00000000-00004240-62148-2428-00422400 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 00000000-00004240-62148-2428-00422400 Assembly shows XOR instruction xor dword ptr [ebp-34h] eax in Stream UID: 00000000-00004240-62148-2601-0045FD57 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-2666-00416EF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-2666-00416EF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004240-62148-2668-004171A4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004240-62148-2668-004171A4 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00004240-62148-2704-0041F5DE Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00004240-62148-2704-0041F5DE Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00004240-62148-2704-0041F5DE Assembly shows XOR instruction xor byte ptr [ebp-000000F0h] al in Stream UID: 00000000-00004240-62148-3073-004443FC Assembly shows XOR instruction xor byte ptr [ebp-60h] al in Stream UID: 00000000-00004240-62148-3073-004443FC Assembly shows XOR instruction xor byte ptr [ebp-5Fh] al in Stream UID: 00000000-00004240-62148-3073-004443FC Assembly shows XOR instruction xor byte ptr [ebp-000000EFh] al in Stream UID: 00000000-00004240-62148-3073-004443FC Assembly shows XOR instruction xor byte ptr [ebp-000000EEh] al in Stream UID: 00000000-00004240-62148-3073-004443FC Assembly shows XOR instruction xor byte ptr [ebp-000000A5h] al in Stream UID: 00000000-00004240-62148-3073-004443FC Assembly shows XOR instruction xor byte ptr [ebp+eax-0000011Ch] 80h in Stream UID: 00000000-00004240-62148-3192-0044C37A Assembly shows XOR instruction xor ebx 10h in Stream UID: 00000000-00004240-62148-3209-004505F0 Assembly shows XOR instruction xor eax 00000100h in Stream UID: 00000000-00004240-62148-3210-004507B7 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004240-62148-3226-00451465 Assembly shows XOR instruction xor edi 000087BCh in Stream UID: 00000000-00004240-62148-3240-00452AC7 Assembly shows XOR instruction xor eax 0000A685h in Stream UID: 00000000-00004240-62148-3240-00452AC7 Assembly shows XOR instruction xor byte ptr [esp+ecx+000011C8h] al in Stream UID: 00000000-00004240-62148-3240-00452AC7 Assembly shows XOR instruction xor edi 08000000h in Stream UID: 00000000-00004240-62148-3331-004590BD Assembly shows XOR instruction xor esi 08000000h in Stream UID: 00000000-00004240-62148-3335-004594E9 Assembly shows XOR instruction xor dword ptr [esp+10h] 08h in Stream UID: 00000000-00004240-62148-3570-00467897 Assembly shows XOR instruction xor dword ptr [ebp+20h] eax in Stream UID: 00000000-00004240-62148-3682-00471BC9 Assembly shows XOR instruction xor eax 00080000h in Stream UID: 00000000-00004240-62148-3773-0047A26A2b:T445,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains references to RC4 cryptographic API (string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm2c:Tc3a,Found XOR loop in file "sample.bin" at offset 10358; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 55834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 68124; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 87054; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 138402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 143756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 246999; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 267741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 532163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 537679; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 606967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 743374; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 754513; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 55476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 115268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 149671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 149699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 309581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 376009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 378119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 384224; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 555854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 781281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 784953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10127; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 96312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 127730; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 142212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 179786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 215319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 238090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 264677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 328371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 474945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 509382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 569597; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 590439; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 667789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 768548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 780357; code bytes = 80302d:T6cb,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")2e:T68b,Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetMonitorInfoW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00004240.00000001.81626.000F0000.00000004.mdmp"2f:Ta45,Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00004240-00000C2C-270478297") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00004240-00000C2C-270479323") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")30:Tabe,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000a60000e4a600fbe3a60000000000000000000000a1000000000174cc8c0000000000d8d98c0095e13a776eba6b00feffffff435c3e7750593e77aa000000b8000000fae3a600f8e3a600fccd8c0034d28c00000000000000000000000000000000000000000000000000401300000000a1001c5c3d7760d83a75ffffffff17000000accd8c0024000000030000009cd28c00c8d78c0034d28c0086000000d8cd8c0096ed3e7722e4a600a06a147586000000fccd8c0034d28c000000000086008800a06a1475fccd8c00916c147522e4a600a06a1475a06a14756cd28c0002020000 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004240)31:T632,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetLastAccessTime" (Indicator: "GetLastAccessTime"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")32:T9c4,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetWindowTextLength" (Indicator: "GetWindowText"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")33:T6fb,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004240)34:T6fe8,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter MoveFileExA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter HeapWalk (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter IsNativeVhdBoot (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter DebugBreak (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetUserGeoID (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetGeoInfoW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RtlGetNtProductType (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LdrLoadDll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LdrUnloadDll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LdrGetDllHandle (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LdrGetProcedureAddress (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RtlAddVectoredExceptionHandler (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RtlCompressBuffer (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RtlDecompressBuffer (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RtlDecompressBufferEx (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SwapMouseButton (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CredEnumerateA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CredEnumerateW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LookupAccountSidA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LookupAccountNameA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ChangeServiceConfigW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SystemFunction032 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SystemFunction033 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter HttpOpenRequestW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetConnectW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetQueryOptionW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetSetOptionW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RpcServerRegisterIf (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RpcServerRegisterIf2 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter RpcServerUseProtseqEpW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter WNetGetProviderNameA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter WNetGetProviderNameW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter LineDDA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CreateTimerQueueTimer (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumDateFormatsA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumDateFormatsExA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumDateFormatsExEx (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumDateFormatsExW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter EnumDateFormatsW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindWindowExA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GrayStringA (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter GrayStringW (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00004240)35:T47f,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateProcessWithLogonW" (Indicator: "CreateProcess"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")36:T603,Sleep@KERNEL32.DLL at 00000000-00004240-62148-1655-00416B04 Sleep@KERNEL32.DLL at 00000000-00004240-62148-1659-00416B49 Sleep@KERNEL32.DLL at 00000000-00004240-62148-1688-00416B95 Sleep@KERNEL32.DLL at 00000000-00004240-62148-1936-0042DFCC Sleep@KERNEL32.DLL at 00000000-00004240-62148-1996-0045178A Sleep@KERNEL32.DLL at 00000000-00004240-62148-2000-00453BC6 Sleep@KERNEL32.DLL at 00000000-00004240-62148-2059-00416BE3 Sleep@KERNEL32.DLL at 00000000-00004240-62148-2267-004091B0 WaitForSingleObject@KERNEL32.DLL at 00000000-00004240-62148-2275-0044B63B WaitForSingleObject@KERNEL32.DLL at 00000000-00004240-62148-2280-004319AC Sleep@KERNEL32.DLL at 00000000-00004240-62148-2281-004331A2 Sleep@KERNEL32.DLL at 00000000-00004240-62148-2574-0040D3B0 SetTimer at 00000000-00004240-62148-2588-00401250 SetTimer at 00000000-00004240-62148-2590-00401100 Sleep@KERNEL32.DLL at 00000000-00004240-62148-2601-0045FD57 Sleep@KERNEL32.DLL at 00000000-00004240-62148-2869-00434582 Sleep@KERNEL32.DLL at 00000000-00004240-62148-2962-00436A0B WaitForSingleObject@KERNEL32.DLL at 00000000-00004240-62148-2967-00436C2B Sleep@KERNEL32.DLL at 00000000-00004240-62148-3058-00443B61 WaitForSingleObject@KERNEL32.DLL at 00000000-00004240-62148-3059-00443C87 SetTimer at 00000000-00004240-62148-3258-00454639 Sleep@KERNEL32.DLL at 00000000-00004240-62148-3565-004671B9 SetTimer at 00000000-00004240-62148-3682-00471BC9 Sleep@KERNEL32.DLL at 00000000-00004240-62148-3714-00476CA4 Sleep@KERNEL32.DLL at 00000000-00004240-62148-3811-0047D40F37:T514,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")38:T402,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")39:T5b8,"SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 62148-2021-004720DB "Software\AutoIt v3\AutoIt" in Source: 62148-2530-0040E4C0 "SOFTWARE\Classes\" in Source: 62148-3317-00458651 "Software\AutoIt v3\AutoIt" in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp 00000000-00004240.00000001.81626.00401000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp 00000000-00004240.00000001.81626.00401000.00000040.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp 00000000-00004240.00000001.81626.00401000.00000040.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004240.00000000.80824.00A10000.00000004.mdmp 00000000-00004240.00000001.81626.00A10000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp3a:T5fe,"Software\AutoIt v3\AutoIt" in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004240.00000000.80824.00A10000.00000004.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "pera Software\Opera Stable" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00004240.00000001.81626.00401000.00000040.mdmp "SOFTWARE\Classes\" in Source: 00000000-00004240.00000001.81626.00401000.00000040.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00004240.00000001.81626.00401000.00000040.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004240.00000001.81626.00A10000.00000004.mdmp3b:T880,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "ADVAPI32.DLL" at base 77200000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "CRYPTBASE.DLL" at base 75190000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "OLEAUT32.DLL" at base 76e70000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75650000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "SETUPAPI.DLL" at base 759b0000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "RPCRT4.DLL" at base 76b10000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "DWMAPI.DLL" at base 73a20000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "COMCTL32.DLL" at base 74190000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "UXTHEME.DLL" at base 73dd0000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "IMM32.DLL" at base 75630000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "COMCTL32" at base 74190000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "SHELL32.DLL" at base 75ec0000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "KERNEL32.DLL" at base 75650000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "USER32.DLL" at base 75b50000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "SHLWAPI.DLL" at base 76fa0000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75140000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 2030000 "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" loaded module "%WINDIR%\TEMP\VXSSL32.DLL" at base 21100003c:Tbdb,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3d:T1143,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "1DC7D0F029AA044DCD3CD08EC2EB4C1CAD19FE9A89B340C6183FF300C724E2AF"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\MOUSE"; Key: "SWAPMOUSEBUTTONS"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "")3e:Ta9b,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe.Local\" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\MPR.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\MPR.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\VERSION.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\WINMM.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\WSOCK32.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\WSOCK32.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\uxtheme.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\FLTLIB.DLL" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\MSVCP140.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll"3f:Td7f,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\MPR.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\VERSION.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\WINMM.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\WSOCK32.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\uxtheme.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\MSVCP140.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\ucrtbase.DLL" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll"40:T524,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe.Local\" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\Windows\system32\uxtheme.dll.Config" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\1DC7D0F029AA044DCD3CD08EC2EB4C1CAD19FE9A89B340C6183FF300C724E2AF.EXE.LOCAL" "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" trying to access non-existent file "C:\Windows\System32\UXTHEME.DLL.CONFIG" "RegSvcs.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "RegSvcs.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\07823960-0d36ffd513#\" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.INI" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\UCBrowser\" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe.Local\"41:T8a7,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004240-00000C2C-270362590") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004240-00000C2C-270367564") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004240-00000C2C-270372456") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004240-00000C2C-270376990") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004240-00000C2C-270383003") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004240-00000C2C-270387471") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004240-00000C2C-270417584") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")42:T50d,Found registry query API: "RegEnumValueW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in file "00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00004240.00000001.81626.000F0000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00004240.00000001.81626.000F0000.00000004.mdmp"43:Ta40,Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")44:T779,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")45:Tef0,"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\*.* (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter 1033 (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter Accessibility.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AddInProcess.exe (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AddInProcess.exe.config (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AddInProcess32.exe (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AddInProcess32.exe.config (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AddInUtil.exe (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AddInUtil.exe.config (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AdoNetDiag.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter adonetdiag.mof (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter adonetdiag.mof.uninstall (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter alink.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AppLaunch.exe (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter applaunch.exe.config (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter ASP.NETWebAdminFiles (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter Aspnet.config (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter aspnet.mof (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter aspnet.mof.uninstall (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter AspNetMMCExt.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter aspnet_compiler.exe (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter aspnet_filter.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter aspnet_isapi.dll (UID: 00000000-00004240) "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" called "FindNextFileW" with parameter Aspnet_perf.dll (UID: 00000000-00004240)46:Tf9b,Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "Pass encoding="base64">" (Indicator: "base64"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "RRmAesDd" (Indicator: "aes"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")47:Tc20,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")48:T54e,Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00004240.00000001.81626.000F0000.00000004.mdmp")49:T782,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe" (Indicator: "\Device\"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.80824.00A10000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000001.81626.00A10000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000001.81626.00A10000.00000004.mdmp")4a:T57c,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")4b:T411,Found reference to API "SetSystemPowerState" (Indicator: "SetSystemPowerState"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; File: "00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "SetSystemPowerState" (Indicator: "SetSystemPowerState"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "InitiateSystemShutdownExW" (Indicator: "InitiateSystemShutdown"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp")4c:T5a2,YARA signature "INDICATOR_EXE_Packed_GEN01" matched process "00000000-00004240" as "Detect packed .NET executables. Mostly AgentTeslaV4." YARA signature "INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL" matched process "00000000-00004240" as "Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion" YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched process "00000000-00004240" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." YARA signature "INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store" matched process "00000000-00004240" as "Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients" matched process "00000000-00004240" as "Detects executables referencing many email and collaboration clients. Observed in information stealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients" matched process "00000000-00004240" as "Detects executables referencing many file transfer clients. Observed in information stealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID" matched process "00000000-00004240" as "Detects executables referencing Windows vault credential objects. Observed in infostealers"4d:T542,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp, 00000000-00006748.00000000.89999.004BA000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp, 00000000-00006748.00000000.89999.004BA000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp")4e:T9b8,Found reference to API "GetDC" (Indicator: "GetDC"; File: "1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp, 00000000-00006748.00000000.89999.004BA000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006748.00000000.89999.00401000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006748.00000000.89999.03700000.00000004.mdmp")4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAB3d3d3d3cAAAAAAAAAAA93d3d3d3d3dwAAAAAAAAD3d3d3d3d3d3d/AAAAAAD3d3d3iIiIiId3d3AAAAAPd3d3j4h3d4iIh3d3AAAA93d3j4d2Z3ZneIiHd3AAAPd3eIdmZmd3ZmZ4iHd/AA93d4h0ZmZ3d2ZkR4iHdwD3d3iHRGZnd3d2ZkR4iHdw93eIdEZmZ3d3dmZkR4h3cIeHiGRGZmd3d3ZmZEaIh3d3d4cAAAQAAAAAAAAAeIh3eHiHCIdwCId3d4iIgHh4d3h4dECIhwCIiIiIiARIeId4eHRmeIgEd3d3iPdER3iHeHh0ZkeIgHd3B4hwZkd4h3h4dGZwiIcHcHeIB2ZHeId4eHZndwiIBGB49nd2Z3iHeIh2Z3dniIAHiHZ3dmd4h3iId3d3hHiIiIcId3Z4eId3iId3d4gIiIjwiId3eHh3h4iHd3iIh4iId4iHd3eId/eIh3d4iId4h3iIh3d4+HD4eIh3eIiId3eIiId3ePdwD3iIh3eIiP+PiIh3d4+H8A/3iId3eIiIiIh3d3j4fwAA+HiIh3d3iIh3d3ePh3AAAA93j4h3d3d3d3eI+HfwAAAA+Hj/iId3d3iI/4d/AAAAAA/3eP//iIj//4d/8AAAAAAA/4d4iP//+Id38AAAAAAAAAD/93d3d3d4/wAAAAD/wAP//gAA//wAAD/wAAAf4AAAD8AAAAfAAAADgAAAAwAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAGAAAABgAAAA8AAAAfgAAAH8AAAD/gAAB/8AAB//wAA/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790709456102,"unified_at":"2026-09-29T19:17:36.102Z","metadata":{"hashes":{"sha256":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","sha1":"b6062c3e351e15e367f69f077ddd0d0c50010871","md5":"547e0100de2c5949bd2d655f7e64a017","sha512":"7347880bc7a5361dbbb9042602b5a13078b67a1acb0f30456ae43a3bf8df2d479025da734b53ff6f37987cfc49213a4c50a9f521d8cb7028f0fafdc34a319933","ssdeep":"12288:v6Wq4aaE6KwyF5L0Y2D1PqLayIVdE+VU72ORBO9ThQngxI+sTELQI4si6JXunBDh:tthEVaPqLUNiyOPxaosPXuBDytC","ssdeep_chunks":["12288:v6Wq4aa","12288:6Wq4aaE","12288:Wq4aaE6","12288:q4aaE6K","12288:4aaE6Kw","12288:aaE6Kwy","12288:aE6KwyF","12288:E6KwyF5","12288:6KwyF5L","12288:KwyF5L0","12288:wyF5L0Y","12288:yF5L0Y2","12288:F5L0Y2D","12288:5L0Y2D1","12288:L0Y2D1P","12288:0Y2D1Pq","12288:Y2D1PqL","12288:2D1PqLa","12288:D1PqLay","12288:1PqLayI","12288:PqLayIV","12288:qLayIVd","12288:LayIVdE","12288:ayIVdE+","12288:yIVdE+V","12288:IVdE+VU","12288:VdE+VU7","12288:dE+VU72","12288:E+VU72O","12288:+VU72OR","12288:VU72ORB","12288:U72ORBO","12288:72ORBO9","12288:2ORBO9T","12288:ORBO9Th","12288:RBO9ThQ","12288:BO9ThQn","12288:O9ThQng","12288:9ThQngx","12288:ThQngxI","12288:hQngxI+","12288:QngxI+s","12288:ngxI+sT","12288:gxI+sTE","12288:xI+sTEL","12288:I+sTELQ","12288:+sTELQI","12288:sTELQI4","12288:TELQI4s","12288:ELQI4si","12288:LQI4si6","12288:QI4si6J","12288:I4si6JX","12288:4si6JXu","12288:si6JXun","12288:i6JXunB","12288:6JXunBD","12288:JXunBDh","24576:v6Wq4aa","24576:6Wq4aaE","24576:Wq4aaE6","24576:q4aaE6K","24576:4aaE6Kw","24576:aaE6Kwy","24576:aE6KwyF","24576:E6KwyF5","24576:6KwyF5L","24576:KwyF5L0","24576:wyF5L0Y","24576:yF5L0Y2","24576:F5L0Y2D","24576:5L0Y2D1","24576:L0Y2D1P","24576:0Y2D1Pq","24576:Y2D1PqL","24576:2D1PqLa","24576:D1PqLay","24576:1PqLayI","24576:PqLayIV","24576:qLayIVd","24576:LayIVdE","24576:ayIVdE+","24576:yIVdE+V","24576:IVdE+VU","24576:VdE+VU7","24576:dE+VU72","24576:E+VU72O","24576:+VU72OR","24576:VU72ORB","24576:U72ORBO","24576:72ORBO9","24576:2ORBO9T","24576:ORBO9Th","24576:RBO9ThQ","24576:BO9ThQn","24576:O9ThQng","24576:9ThQngx","24576:ThQngxI","24576:hQngxI+","24576:QngxI+s","24576:ngxI+sT","24576:gxI+sTE","24576:xI+sTEL","24576:I+sTELQ","24576:+sTELQI","24576:sTELQI4","24576:TELQI4s","24576:ELQI4si","24576:LQI4si6","24576:QI4si6J","24576:I4si6JX","24576:4si6JXu","24576:si6JXun","24576:i6JXunB","24576:6JXunBD","24576:JXunBDh","12288:tthEVaP","12288:thEVaPq","12288:hEVaPqL","12288:EVaPqLU","12288:VaPqLUN","12288:aPqLUNi","12288:PqLUNiy","12288:qLUNiyO","12288:LUNiyOP","12288:UNiyOPx","12288:NiyOPxa","12288:iyOPxao","12288:yOPxaos","12288:OPxaosP","12288:PxaosPX","12288:xaosPXu","12288:aosPXuB","12288:osPXuBD","12288:sPXuBDy","12288:PXuBDyt","12288:XuBDytC"],"imphash":"890e522b31701e079a367b89393329e6","pehash":"0a94708d0376c8c9f84533403871aeb3038c5465"},"file_info":{"file_name":"bounty-26408875152785131","file_type":["peexe","autoit","executable"],"file_type_id":"autoit","file_size":802895,"entropy":8,"compile_timestamp":"2012-01-29T21:32:28","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1728481448000,"last_seen":1787874212000,"last_multi_scan":1787874212000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":"UPX0","virtual_address":"0x1000","virtual_size":483328},{"name":"UPX1","virtual_address":"0x77000","virtual_size":274432,"raw_size":270848},{"name":".rsrc","virtual_address":"0xba000","virtual_size":32768,"raw_size":29696}],"section_names":["UPX0","UPX1",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","sublink","rat","autoit","njrat","pistolar","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":249,"suspicious_count":25,"malicious_count":13,"total":287},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AutoitInject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Formbook.384;AIT:Trojan.Formbook.384","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Formbook.384 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.Autoit.GLA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005e5fab1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/AuItInj-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W32/Formbook.h","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/AutoIt.ABH.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.AutoIt_Heur.L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.Win32.1886611","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"AIT:Trojan.Formbook.384;AIT:Trojan.Formbook","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"AgentTesla","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"UMBRAL BISON","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"},{"type":"informative","value":"Contains ability to register hotkeys"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Contains ability to empty the Recycle Bin on the specified drive"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Able to perform cryptographic operations"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Contains references to RC4 cryptographic API (string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Contains ability to block user input"},{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Regsvcs/Regasm","attack_id":"T1218.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/009","identifiers":[{"type":"informative","value":"Detected regasm.exe/regsvcs.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to simulate user keyboard/mouse input"},{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"},{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Able to download remote files using web shell script"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"suspicious","value":"Able to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-225","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-222","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-257","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1135","id":"string-923","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"h$v.er\", Heuristic match: \"ccw.tk\", Heuristic match: \"*\t|.ng\", Heuristic match: \"h=.va\", Heuristic match: \"z\n.kp\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"EnumProcesses\" (Indicator: \"EnumProcesses\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetAce\" (Indicator: \"GetAce\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"RegSvcs.exe\" queried SystemProcessInformation at 00000000-00000880-00000105-11052046 [PID: 880]\n \"RegSvcs.exe\" queried SystemProcessInformation at 00000000-00000880-00000105-11054230 [PID: 880]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004240-62148-1638-0041A208\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004240-62148-1645-00417DAA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004240-62148-4833-0041F250","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004240.00000000.80824.00A10000.00000004.mdmp, 00000000-00004240.00000001.81626.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains references to RC4 cryptographic API (string)","description":"Found reference to API \"SystemFunction032\" (Indicator: \"systemfunction032\"; Source: \"00000000-00004240-00000C2C-270361492\")\n Found reference to API \"SystemFunction033\" (Indicator: \"systemfunction033\"; Source: \"00000000-00004240-00000C2C-270362046\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-897","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.96887","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00004240-00000C2C-270482895\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00004240-00000C2C-270327058\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; Source: \"00000000-00004240-00000C2C-270327951\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004240-00000C2C-270462874\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"IsWow64Process\" with parameter \"4240\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004240-62148-2704-0041F5DE\n GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00004240-62148-3714-00476CA4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"8228818,3580,3150,,IsWow64Process,kernel32.dll,\"252:06:34.881\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004240.00000000.80824.00A10000.00000004.mdmp\")\n Found reference to API \"9541394,3580,3150,,IsWow64Process,kernel32.dll,\"252:06:46.285\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004240.00000001.81626.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-2479-004339B6\n FindNextFileW@KERNEL32.DLL at 00000000-00004240-62148-2812-00431A86\n FindNextFileW@KERNEL32.DLL at 00000000-00004240-62148-3033-00442886\n FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-3186-0044BD27\n FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-3187-0044BF8B\n FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-3239-00452492\n FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-3450-0045CAFA\n FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-3467-0045DE8F\n FindNextFileW@KERNEL32.DLL at 00000000-00004240-62148-3563-00467001\n FindFirstFileW@KERNEL32.DLL at 00000000-00004240-62148-3735-004788BD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00004240-62148-3464-0045D94B\n GetDriveTypeW@KERNEL32.DLL at 00000000-00004240-62148-3465-0045DA73\n GetDriveTypeW@KERNEL32.DLL at 00000000-00004240-62148-3734-00478656","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004240-62148-2088-004148B3\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004240-62148-2704-0041F5DE\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00004240-62148-3735-004788BD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00004240-62148-2021-004720DB\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004240-62148-2088-004148B3\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004240-62148-2704-0041F5DE\n GetLocalTime@KERNEL32.DLL at 00000000-00004240-62148-2833-00432A10\n GetLocalTime@KERNEL32.DLL at 00000000-00004240-62148-3468-0045DF23","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00004240-62148-2031-0041E364","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00004240-62148-2511-0040E500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00004240-62148-3461-0045D619\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00004240-62148-3462-0045D78F\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00004240-62148-3463-0045D86D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cd door\" (Indicator: \"set \"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00004240-62148-2511-0040E500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardLayoutNameW@USER32.DLL at 00000000-00004240-62148-2021-004720DB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"386548,3580,3024,,RtlGetVersion,NTDLL.dll,\"252:06:34.320\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004240.00000000.80824.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-2008-00433D9E\n GetProcessHeap@KERNEL32.DLL at 00000000-00004240-62148-2430-004238DA\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004240-62148-2842-004333BE\n OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-2858-00433FCE\n OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-2865-004343AD\n GetProcessHeap@KERNEL32.DLL at 00000000-00004240-62148-2964-00436B91\n GetProcessHeap@KERNEL32.DLL at 00000000-00004240-62148-2965-00436BA9\n GetProcessHeap@KERNEL32.DLL at 00000000-00004240-62148-2969-00436B19\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004240-62148-2975-00436E94\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004240-62148-2976-00436F47\n OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-3309-00457AD9\n OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-3535-00464EAE\n OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-3706-004757A7\n OpenProcess@KERNEL32.DLL at 00000000-00004240-62148-3828-0048127D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, edi\" and \"je 0041E55Dh\" at 00000000-00004240-62148-2031-0041E364\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00432B89h\" at 00000000-00004240-62148-2833-00432A10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"RegSvcs.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" at 00000000-00000880-0000010C-10826181","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in file \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00004240-00000C2C-270307179\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00004240-00000C2C-270308678\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004240-00000C2C-270309579\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"CreateProcessW\" with parameter \"\"C:\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\"\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$34","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00004240-62148-1640-0042009C\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2094-00430DC1\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2514-0040EFD0\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2517-0040EF60\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2526-0040EBD0\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2777-00430C7F\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2781-00430E7B\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2787-0043129A\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2788-004312CC\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2789-004312FE\n LoadLibraryA@KERNEL32.DLL at 00000000-00004240-62148-2880-00434B02\n LoadLibraryW@KERNEL32.DLL at 00000000-00004240-62148-2991-00440C49\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004240-62148-3267-00454E8D\n LoadLibraryW@KERNEL32.DLL at 00000000-00004240-62148-3307-0045774C\n LoadLibraryW@KERNEL32.DLL at 00000000-00004240-62148-3531-00464812","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.DLL at 00000000-00004240-62148-2307-00401CB0\n UnregisterHotKey@USER32.DLL at 00000000-00004240-62148-3643-0046D536","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.009","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process RegSvcs.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process RegSvcs.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Detected regasm.exe/regsvcs.exe process execution","description":"Process \"RegSvcs.exe\" with commandline \"\"C:\\\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\"\" (UID: 00000000-00000880)","origin":"Monitored Target","mitre_attack_id":"T1218.009","relevance":3,"id":"target-216","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"avsupport@autoitscript.com\"\n Pattern match: \"rchman@elquijotebanquetes.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"RegSvcs.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63850000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"RegSvcs.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"RegSvcs.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 644B0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64C60000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B10000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76B10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e82c6b@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e82c6b@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f2c6b@ntdll.dll\"\n \"0b000c0004f22776@ADVAPI32.dll\"\n \"110012009e28ba76@CRYPTBASE.dll\"\n \"150016002073686b@ADVAPI32.dll\"\n \"0e000f00e473686b@ADVAPI32.dll\"\n \"0e000f005074686b@ADVAPI32.dll\"\n \"11001200d47d686b@ADVAPI32.dll\"\n \"110012007c7e686b@ADVAPI32.dll\"\n \"12001300cc7e686b@ADVAPI32.dll\"\n \"12001300387f686b@ADVAPI32.dll\"\n \"14001500e4b7686b@ADVAPI32.dll\"\n \"1400150000b8686b@ADVAPI32.dll\"\n \"140015001cb8686b@ADVAPI32.dll\"\n \"1700180038b8686b@ADVAPI32.dll\"\n \"0d000e0054b8686b@ADVAPI32.dll\"\n \"1100120064b8686b@ADVAPI32.dll\"\n \"110012007cb8686b@ADVAPI32.dll\"\n \"0d000e009090686b@WININET.dll\"\n \"0d000e000c91686b@WININET.dll\"\n \"100011004c91686b@WININET.dll\"\n \"100011000492686b@WININET.dll\"\n \"10001100ccb8686b@WININET.dll\"\n \"10001100e0b8686b@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" was detected as \"UPX\" and name: \"Packer\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" [Source: 00000000-00004240-00000C47-9543601036]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RegSvcs.exe\" (UID: 00000000-00000880) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"RegSvcs.exe\" (UID: 00000000-00000880) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RegSvcs.exe\" with commandline \"\"C:\\\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c72 ...\" (UID: 00000000-00000880)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"RegSvcs.exe\" with commandline \"\"C:\\\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c72 ...\" (UID: 00000000-00000880)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Gehman\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" connecting to \"\\ThemeApiPort\"\n \"RegSvcs.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00004240-62148-2021-004720DB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Gehman\" has type \"data\"- Location: [%TEMP%\\Gehman]- [targetUID: 00000000-00004240]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"RegSvcs.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 880)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" reads file \"c:\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gehman\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\regsvcs.exe\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" reads file \"c:\\windows\\system32\\ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Reference to an external IP address lookup service identified\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to identify external IP address\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to query volume size","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gehman\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" writes file \"%temp%\\gehman\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"Found string \"HttpWebRequest\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=hosting\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00004240-00000C2C-270462373\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004240.00000000.80824.00F70000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"255.255.255.255\"\n \"5.255.255.255\"\n \"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004240\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"OFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00004240-00000C2C-270280390\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00004240-00000C2C-270281498\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"386548,3580,3024,,RtlGetVersion,NTDLL.dll,\"252:06:34.320\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004240.00000000.80824.00A10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$48","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"oftware\\Microsoft\\Office\\11.0\\Outlook\\Profiles\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"oftware\\Microsoft\\Office\\12.0\\Outlook\\Profiles\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"oftware\\Microsoft\\Office\\14.0\\Outlook\\Profiles\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"oftware\\Microsoft\\Office\\15.0\\Outlook\\Profiles\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"oftware\\Microsoft\\Office\\16.0\\Outlook\\Profiles\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"VirtualStore\\Program Files\\Foxmail\\mail\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"VirtualStore\\Program Files (x86)\\Foxmail\\mail\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp\n \"Opera Mail\\Opera Mail\\wand.dat\" in Source: 00000000-00004240.00000001.81626.000F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"elect * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found string \"ELECT * FROM Win32_VideoController\" (Indicator: \" Win32_VideoController\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"FTP Navigator\\Ftplist.txt\" (Indicator: \"ftp navigator\")\n \"FTP Navigator\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"cftp\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00004240-00000C2C-270359037\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00004240-00000C2C-270359632\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$49","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004240.00000001.81626.000F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004240.00000001.81626.00401000.00000040.mdmp\n Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00004240.00000000.80824.00401000.00000040.mdmp\n 00000000-00004240.00000001.81626.00401000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00004240.00000001.81626.00401000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004240.00000000.80824.00401000.00000040.mdmp, 00000000-00004240.00000001.81626.000F0000.00000004.mdmp, 00000000-00004240.00000001.81626.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" opened \"\\Device\\KsecDD\"\n \"RegSvcs.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00000000-00004240-62148-3351-0045A370","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1562.001","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"RegSvcs.exe queries ProcessDebugPort (UID: 880)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Able to perform cryptographic operations","description":"Found strings that indicate potentially cryptographic operations: createdecryptor\n computehash\n rijndaelmanaged\n createencryptor\n md5cryptoserviceprovider\n cryptography","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-962","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/24 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00004240-62148-2838-0043305F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"$4c","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to empty the Recycle Bin on the specified drive","description":"SHEmptyRecycleBinW@SHELL32.DLL at 00000000-00004240-62148-3454-0045D0D9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":3,"id":"stream-114","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00004240-62148-2548-0040D6B0\n SystemParametersInfoW@USER32.DLL at 00000000-00004240-62148-3331-004590BD\n SystemParametersInfoW@USER32.DLL at 00000000-00004240-62148-3682-00471BC9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"RegSvcs.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Type: \"FileHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@KERNEL32.DLL at 00000000-00004240-62148-2813-00431BE8\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00004240-62148-3184-0044BB30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Able to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00004240-62148-2842-004333BE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"mouse_event@USER32.DLL at 00000000-00004240-62148-2840-0043333C\n keybd_event@USER32.DLL at 00000000-00004240-62148-2866-00434418\n keybd_event@USER32.DLL at 00000000-00004240-62148-2871-0043471D\n mouse_event@USER32.DLL at 00000000-00004240-62148-3018-00441FD6\n mouse_event@USER32.DLL at 00000000-00004240-62148-3182-0044BA68\n mouse_event@USER32.DLL at 00000000-00004240-62148-3183-0044BACC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" called \"CreateProcessW\" with parameter \"\"C:\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\"\" - (UID: 00000000-00004240)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"RegSvcs.exe\" connects to 208.95.112.1:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/24 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_AgentTeslaV2\" matched process \"00000000-00004240\" as \"AgenetTesla Type 2 Keylogger payload\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Agent Tesla","description":"YARA signature Malware.Agent Tesla matched on process \"00000000-00004240\"","origin":"YARA Signature","relevance":9,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"RegSvcs.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\UCBrowser\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006748.00000000.89999.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00006748.00000000.89999.06460000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00006748.00000000.89999.06460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Wed\n 09 Oct 2024 13:44:47 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has an executable section named \"UPX0\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has an writable section named \"UPX0\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has an writable section named \"UPX1\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x477000,lea\tedi, [esi - 0x76000],push\tedi,jmp\t0x4b8e8a,nop\t,mov\tal, byte ptr [esi],inc\tesi,mov\tbyte ptr [edi], al,inc\tedi,add\tebx, ebx,jne\t0x4b8e91,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x4b8e80,mov\teax, 1,add\tebx, ebx,jne\t0x4b8ea3,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,add\tebx, ebx,jae\t0x4b8eb4,jne\t0x4b8ed3,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x4b8ed3,dec\teax,add\tebx, ebx,jne\t0x4b8ec0,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,jmp\t0x4b8e98,add\tebx, ebx,jne\t0x4b8ecf,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\tecx, ecx,jmp\t0x4b8f25,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=hosting\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: 1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"VkKeyScanW\" (Indicator: \"VkKeyScan\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"GetUserObjectSecurity\" (Indicator: \"GetUserObjectSecurity\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"GetAce\" which can \"Obtains a pointer to an access control entry (ACE) in an access control list (ACL)\" [Source: 1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\REGSVCS.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00006748.00000000.89999.06460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has a section named \"UPX0\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has section name UPX1 with entropy \"7.9289414193\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006748.00000000.89999.03700000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"avsupport@autoitscript.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_DIALOG:7.09911531642\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_STRING:7.77225023638\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_STRING:7.80708459093\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_STRING:7.76290337798\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_STRING:7.77663650962\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_STRING:7.66925437372\"\n \"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has resource with unusual entropy \"RT_STRING:7.65928637348\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00006748.00000000.89999.06460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00006748.00000000.89999.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n EnumProcesses\n FtpOpenFileW\n recv","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" (PID: 201c)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" (Handle: 808)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ip-api.com\" (Indicator: \"ip-api.com\"; File: \"PCAP\")\n \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\" (Indicator: \"ip-api.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"name":"Spyware","details_count":7,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"intel_graph":{"map":{"Adversary:c40c2a3ce1aea32d452543e2a896ee1ab52d1a85083dcae0d10b7566f12d577c":{"type":"Adversary","value":"UMBRAL BISON","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7":{"type":"Domain","value":"ip-api.com","verdict":{"verdict":"unknown"}},"File:003c498d18811ff4bb56090f4540db8de18ddcc815f5d9c1337c9a29b83886e1":{"type":"File","value":"003c498d18811ff4bb56090f4540db8de18ddcc815f5d9c1337c9a29b83886e1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:1a74e820d6a6e822f725a87d1ec45dd5cd2c913d586b4bdcaec272e7d4c5b8c0":{"type":"File","value":"1a74e820d6a6e822f725a87d1ec45dd5cd2c913d586b4bdcaec272e7d4c5b8c0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (DLL) (console) Intel 80386, for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af":{"type":"File","value":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Attempts to query public IP/geolocation using external service","Detected malicious dynamic behaviour","Detected malware C2 configuration","Detected relationship with a Threat AgentTesla","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat AgentTesla","confirmed relationship with an Adversary UMBRAL BISON"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe":{"type":"File","value":"213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Attempts to query public IP/geolocation using external service","Detected malware C2 configuration","Detected relationship with a Threat AgentTesla","confirmed relationship with an Adversary UMBRAL BISON"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:29abceafd8094a3fe45c77f36cad3e5394ae6aa35b4b46beaf1f2e1bcfb885b3":{"type":"File","value":"29abceafd8094a3fe45c77f36cad3e5394ae6aa35b4b46beaf1f2e1bcfb885b3","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:2dbdcab78e53143c0d8f67790723152ecb05e8bd089ff36ab528a01c651b099a":{"type":"File","value":"2dbdcab78e53143c0d8f67790723152ecb05e8bd089ff36ab528a01c651b099a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:514bc1e2d6a978047c5a8b729a45dd743f49d9bb6684bc2a5bfc9ad8ec8eb1d8":{"type":"File","value":"514bc1e2d6a978047c5a8b729a45dd743f49d9bb6684bc2a5bfc9ad8ec8eb1d8","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:5aa9bcf317dfeed317b98893369470dd8095d8fa0341fd8fc033b576f82761d0":{"type":"File","value":"5aa9bcf317dfeed317b98893369470dd8095d8fa0341fd8fc033b576f82761d0","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef":{"type":"File","value":"5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:62f7ef2652ad515525bf4fabe7a91b979109813cf2d3bbc17f9bd0d6397ebf08":{"type":"File","value":"62f7ef2652ad515525bf4fabe7a91b979109813cf2d3bbc17f9bd0d6397ebf08","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:6312b64dc3f3ed6feefc4dfe6e7bd952c9cc8e1575cefe84155885c9b0c8cb86":{"type":"File","value":"6312b64dc3f3ed6feefc4dfe6e7bd952c9cc8e1575cefe84155885c9b0c8cb86","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:8831198e6de2ebfb98767d834f9ddd1fa0b65d9800f36c1e01543db6bc23172a":{"type":"File","value":"8831198e6de2ebfb98767d834f9ddd1fa0b65d9800f36c1e01543db6bc23172a","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:a5c7d83789e05319ada630e8b87f9a0d0f640b23fddd320ef131d8f8fbac885c":{"type":"File","value":"a5c7d83789e05319ada630e8b87f9a0d0f640b23fddd320ef131d8f8fbac885c"},"File:ada07ab4775e705fdf2de85a9631ff2bce5a1b587fd97f08e4c50050b66647e1":{"type":"File","value":"ada07ab4775e705fdf2de85a9631ff2bce5a1b587fd97f08e4c50050b66647e1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"ASCII text, with very long lines (810)","filetype_short":"ASCIITEXT","mime_type":"application/x-powershell"},"File:be36f5101723af55bad0fd7e3345cc2f402dafe36dcb6aae1acb085dfdadcfaf":{"type":"File","value":"be36f5101723af55bad0fd7e3345cc2f402dafe36dcb6aae1acb085dfdadcfaf","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:c5fe7adb5771cdf575d7063e08bdea3b405a534c8e20e23f78927031a0a5a9a1":{"type":"File","value":"c5fe7adb5771cdf575d7063e08bdea3b405a534c8e20e23f78927031a0a5a9a1","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from detonation memory_region)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87":{"type":"File","value":"ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Attempts to query public IP/geolocation using external service","Detected malware C2 configuration","Detected relationship with a Threat AgentTesla","confirmed relationship with an Adversary UMBRAL BISON"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f6e28ad1753237d42be72be187a88f09a269097eeda24bcf12908db6bd361246":{"type":"File","value":"f6e28ad1753237d42be72be187a88f09a269097eeda24bcf12908db6bd361246","verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]},"filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1":{"type":"File","value":"f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Attempts to query public IP/geolocation using external service","Detected malware C2 configuration","Detected relationship with a Threat AgentTesla","confirmed relationship with an Adversary UMBRAL BISON"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161":{"type":"Threat","value":"AgentTesla","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat AgentTesla","confirmed relationship with an Adversary UMBRAL BISON"]}},"Url:/line/?fields=hosting":{"type":"Url","value":"/line/?fields=hosting"},"Url:68ee66dd1f0684f8eb4e6921a7e025160e9fa53322c98021c62b6bf5fa8b3d14":{"type":"Url","value":"ftp://ftp.elquijotebanquetes.com:21/","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1542681024905070042","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Attempts to query public IP/geolocation using external service","Detected malicious dynamic behaviour","Detected malware C2 configuration","Detected relationship with a Threat AgentTesla","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat AgentTesla","confirmed relationship with an Adversary UMBRAL BISON"]}},{"id":"1542681023250260005","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"contacted_domain","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7"}],"verdict":{"verdict":"unknown"}},{"id":"1542681023900377160","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:003c498d18811ff4bb56090f4540db8de18ddcc815f5d9c1337c9a29b83886e1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023833268291","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:1a74e820d6a6e822f725a87d1ec45dd5cd2c913d586b4bdcaec272e7d4c5b8c0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681025483883995","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023938125897","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:29abceafd8094a3fe45c77f36cad3e5394ae6aa35b4b46beaf1f2e1bcfb885b3"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023946514506","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:2dbdcab78e53143c0d8f67790723152ecb05e8bd089ff36ab528a01c651b099a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023959097419","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:514bc1e2d6a978047c5a8b729a45dd743f49d9bb6684bc2a5bfc9ad8ec8eb1d8"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023971680332","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:62f7ef2652ad515525bf4fabe7a91b979109813cf2d3bbc17f9bd0d6397ebf08"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023984263245","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:6312b64dc3f3ed6feefc4dfe6e7bd952c9cc8e1575cefe84155885c9b0c8cb86"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023996846158","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:8831198e6de2ebfb98767d834f9ddd1fa0b65d9800f36c1e01543db6bc23172a"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681024009429071","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:ada07ab4775e705fdf2de85a9631ff2bce5a1b587fd97f08e4c50050b66647e1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681024017817680","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:be36f5101723af55bad0fd7e3345cc2f402dafe36dcb6aae1acb085dfdadcfaf"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681024030400593","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:c5fe7adb5771cdf575d7063e08bdea3b405a534c8e20e23f78927031a0a5a9a1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681025525827036","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681025584547293","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681046701950885","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with an Adversary UMBRAL BISON"]}},{"id":"1542681024068149330","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:1a74e820d6a6e822f725a87d1ec45dd5cd2c913d586b4bdcaec272e7d4c5b8c0"},{"edge_kind":"extracted_from_archive","from_key":"File:1a74e820d6a6e822f725a87d1ec45dd5cd2c913d586b4bdcaec272e7d4c5b8c0","to_key":"File:5aa9bcf317dfeed317b98893369470dd8095d8fa0341fd8fc033b576f82761d0"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023250260013","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe"},{"edge_kind":"is_threat","from_key":"File:213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe","to_key":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542681023250260016","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe"},{"edge_kind":"contains_c2_config","from_key":"File:213215574964beac6055f2cd9e7935b9394ce1aab54d0a723682700dbbac21fe","to_key":"Url:68ee66dd1f0684f8eb4e6921a7e025160e9fa53322c98021c62b6bf5fa8b3d14"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542681024080732243","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87"},{"edge_kind":"extracted_from_archive","from_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87","to_key":"File:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023250260012","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87"},{"edge_kind":"is_threat","from_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87","to_key":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542681023250260015","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87"},{"edge_kind":"contains_c2_config","from_key":"File:ce0e8360bbd6f9666260fe3c351bb846a8423fff4b670d270b5bb975b2261a87","to_key":"Url:68ee66dd1f0684f8eb4e6921a7e025160e9fa53322c98021c62b6bf5fa8b3d14"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542681024093315156","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1"},{"edge_kind":"extracted_from_archive","from_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1","to_key":"File:f6e28ad1753237d42be72be187a88f09a269097eeda24bcf12908db6bd361246"}],"verdict":{"verdict":"suspicious","verdict_source":"dynamic analysis","reasons":["Attempts to query public IP/geolocation using external service"]}},{"id":"1542681023250260014","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1"},{"edge_kind":"is_threat","from_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1","to_key":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542681023254454321","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"memory","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1"},{"edge_kind":"contains_c2_config","from_key":"File:f8e0c4e52c957f9829b916c255302dfe259cd5132316d007986916d5d2baf4b1","to_key":"Url:68ee66dd1f0684f8eb4e6921a7e025160e9fa53322c98021c62b6bf5fa8b3d14"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542681027377496049","root":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161","edges":[{"edge_kind":"used_by","from_key":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161","to_key":"Adversary:c40c2a3ce1aea32d452543e2a896ee1ab52d1a85083dcae0d10b7566f12d577c"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542681027373301743","root":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"contacted_ip","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"Domain:f7864750d075d8a7a1b852ca3083aab9e11af5f37ee15dfa26a2caacc5ebede7"},{"edge_kind":"contacted_url","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"Url:/line/?fields=hosting"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","edges":[{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:ada07ab4775e705fdf2de85a9631ff2bce5a1b587fd97f08e4c50050b66647e1"},{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:8831198e6de2ebfb98767d834f9ddd1fa0b65d9800f36c1e01543db6bc23172a"},{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:f6e28ad1753237d42be72be187a88f09a269097eeda24bcf12908db6bd361246"},{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"},{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:5aa9bcf317dfeed317b98893369470dd8095d8fa0341fd8fc033b576f82761d0"},{"edge_kind":"extracted","from_key":"File:1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","to_key":"File:a5c7d83789e05319ada630e8b87f9a0d0f640b23fddd320ef131d8f8fbac885c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":137,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":1,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["bladabindi","sublink","rat","autoit","njrat","pistolar","evasive","windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a83673450147749840cf54a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Formbook.h","contacted_countries":["USA"],"submit_name":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","analysis_start_time":"2026-08-17T19:55:33+00:00","indicators_count":{"informative":217,"suspicious":65,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"670688a8113d1f1ca400324c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ZZZ"],"submit_name":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","analysis_start_time":"2024-10-09T13:44:08+00:00","indicators_count":{"informative":152,"suspicious":23,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"dns_resolutions":[{"domain":"ip-api.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"http_requests":[{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/line/?fields=hosting","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"embedded_domains":[{"value":"ip-api.com","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"ftp://ftp.elquijotebanquetes.com:21/","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}],"processes":[{"pid":4240,"ppid":0,"name":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe","command_line":"","sha256":"1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af","normalized_path":"C:\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe","uid":"00000000-00004240","icon":"$4f"},{"pid":880,"ppid":4240,"name":"RegSvcs.exe","command_line":"\"C:\\1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af.exe\"","sha256":"c09191a1a46b7bfa82e381c5a0cc5fae83787d63f550a8bd6beaf33cc5c0c344","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe","parent_uid":"00000000-00004240","uid":"00000000-00000880"}],"all_imported_dlls":["System.Management.ni.dll","wbemprox.dll","dnsapi.dll","oleaut32.dll","nsi.dll","vcruntime140.dll","apphelp.dll","sechost.dll","shlwapi.dll","winmm.dll","System.Windows.Forms.ni.dll","kernel32.dll","KernelBase.dll","wbemcomn2.dll","comctl32.dll","imm32.dll","msvcp140.dll","RpcRtRemote.dll","rpcrt4.dll","VxSSL32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","fltLib.dll","devobj.dll","shell32.dll","api-ms-win-crt-math-l1-1-0.dll","System.Configuration.ni.dll","mpr.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-utility-l1-1-0.dll","WMINet_Utils.dll","userenv.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","wship6.dll","api-ms-win-core-file-l1-2-0.dll","cfgmgr32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","setupapi.dll","uxtheme.dll","ucrtbase_clr0400.dll","sspicli.dll","rtutils.dll","vaultcli.dll","normaliz.dll","api-ms-win-crt-time-l1-1-0.dll","winhttp.dll","msctf.dll","rasapi32.dll","version.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","ws2_32.dll","api-ms-win-crt-locale-l1-1-0.dll","System.Xml.ni.dll","bcrypt.dll","user32.dll","ucrtbase.dll","rpcss.dll","rsaenh.dll","clbcatq.dll","wmiutils.dll","WSHTCPIP.DLL","dhcpcsvc.dll","comdlg32.dll","api-ms-win-core-localization-l1-2-0.dll","FWPUCLNT.DLL","wsock32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","webio.dll","credssp.dll","System.Security.ni.dll","ntdll.dll","psapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","rasman.dll","api-ms-win-crt-heap-l1-1-0.dll","System.Core.ni.dll","gdi32.dll","iertutil.dll","advapi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","cryptbase.dll","mscoreei.dll","System.ni.dll","nlssorting.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","usp10.dll","ole32.dll","System.Drawing.ni.dll","cryptsp.dll","fastprox.dll","rasadhlp.dll","api-ms-win-crt-string-l1-1-0.dll","mscoree.dll","ntdsapi.dll","vcruntime140_clr0400.dll","winnsi.dll","msvcrt.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dwmapi.dll","clrjit.dll","lpk.dll","profapi.dll","wininet.dll","clr.dll","mscorlib.ni.dll","wbemsvc.dll","mswsock.dll","System.Management.dll","msvcp_win.dll","windows.storage.dll","bcryptprimitives.dll","combase.dll","kernel.appcore.dll","wow64cpu.dll","powrprof.dll","aepic.dll","wbemcomn.dll","wow64.dll","win32u.dll","ntmarta.dll","WinTypes.dll","System.Security.dll","SHCore.dll","wow64win.dll","cldapi.dll","gdi32full.dll","OnDemandConnRouteHelper.dll","System.Windows.Forms.dll","winmmbase.dll","System.Drawing.dll","Accessibility.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\2\\aut35CF.tmp","sha256":"ada07ab4775e705fdf2de85a9631ff2bce5a1b587fd97f08e4c50050b66647e1","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"8831198e6de2ebfb98767d834f9ddd1fa0b65d9800f36c1e01543db6bc23172a","sha256":"8831198e6de2ebfb98767d834f9ddd1fa0b65d9800f36c1e01543db6bc23172a","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"f6e28ad1753237d42be72be187a88f09a269097eeda24bcf12908db6bd361246","sha256":"f6e28ad1753237d42be72be187a88f09a269097eeda24bcf12908db6bd361246","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","sha256":"5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"5aa9bcf317dfeed317b98893369470dd8095d8fa0341fd8fc033b576f82761d0","sha256":"5aa9bcf317dfeed317b98893369470dd8095d8fa0341fd8fc033b576f82761d0","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Gehman","sha256":"a5c7d83789e05319ada630e8b87f9a0d0f640b23fddd320ef131d8f8fbac885c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"files_written":[{"path":"%TEMP%\\Gehman","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"},{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a83673450147749840cf54a"}]},{"name":"Local\\SM0:6748:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]},{"name":"SM0:6748:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"670688a8113d1f1ca400324c"}]}]}},"report_ids":{"sandbox_job_ids":["6a83673450147749840cf54a","670688a8113d1f1ca400324c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious AIT:Trojan.Formbook.384;AIT:Trojan.Formbook Sample 1dc7d0f029aa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1dc7d0f029aa…. Malware family: AIT:Trojan.Formbook.384;AIT:Trojan.Formbook. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af"}],["$","meta","4",{"property":"og:title","content":"Malicious AIT:Trojan.Formbook.384;AIT:Trojan.Formbook Sample 1dc7d0f029aa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1dc7d0f029aa…. Malware family: AIT:Trojan.Formbook.384;AIT:Trojan.Formbook. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1dc7d0f029aa044dcd3cd08ec2eb4c1cad19fe9a89b340c6183ff300c724e2af"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious AIT:Trojan.Formbook.384;AIT:Trojan.Formbook Sample 1dc7d0f029aa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1dc7d0f029aa…. Malware family: AIT:Trojan.Formbook.384;AIT:Trojan.Formbook. Threat score 100/100. 14/25 AV engines flagged this file. 13 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L50","11",{}]]