24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 276cbe0ca43a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 276cbe0ca43a…. Malware family: Trojan.Generic. Threat score 100/100. 7/25 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf"],"about":{"@type":"SoftwareApplication","name":"b1ad5aa40c89bce3ed9d22762085fb2b.exe","applicationCategory":["peexe","executable"],"identifier":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":9,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4fe4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CryptHashPublicKeyInfo"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ConnectNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumePathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpSendRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "CommandLineToArgvW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpQueryInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API (Indicator: "ReportEventW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "OpenEventLogW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "VerSetConditionMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "InternetErrorDlg"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "DisplayVersion"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceConfigW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpOpenRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CreateNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "InternetConnectW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "PathCanonicalizeW"; Source: "sample.bin"), Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCrackUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "InternetSetOptionW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CloseEventLog"; Source: "sample.bin"), Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin")26:T492,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin")27:T415,Found string "Verification secret from parent is too big." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to write secret length to pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to write secret to pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to read verification secret from parent pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to allocate pipe secret." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to set download password." (Indicator: "password"; Source: "sample.bin"), Found string "Failed to read size of verification secret from parent pipe." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to copy connection secret from command line." (Indicator: "secret"; Source: "sample.bin"), Found string "Verification secret from parent does not match." (Indicator: "secret"; Source: "sample.bin"), Found string "Failed to allocate buffer for verification secret." (Indicator: "secret"; Source: "sample.bin")28:T465,Found reference to API "CryptHashPublicKeyInfo" (Indicator: "CryptHashPublicKeyInfo"; Source: "sample.bin"), Found reference to API "CryptHashData" (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; Source: "sample.bin"), Found reference to API "CryptCATAdminCalcHashFromFileHandle" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; Source: "sample.bin"), Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; Source: "sample.bin")29:Tb4b,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadResource with parameter {'hModule': '1697906688', 'hResInfo': '1698780840'}" (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadResource with parameter {'hModule': '2162689', 'hResInfo': '2163344'}" (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadResource with parameter {'hModule': '1697906688', 'hResInfo': '1698780840'}" (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadResource with parameter {'hModule': '2883585', 'hResInfo': '2884240'}" (UID: 00000000-00005712) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193112'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191992'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193128'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191720'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193144'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191736'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193160'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191752'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193176'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191768'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193208'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191800'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345193192'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1343356928', 'hResInfo': '1345191784'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4325696'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4325648'}" (UID: 00000000-00005792) "RttHlp.exe" called "LoadResource with parameter {'hModule': '1995898880', 'hResInfo': '5375472'}" (UID: 00000000-00005792)2a:Tf9c,Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-324-0043CD83 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-324-0043CD83 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1453-00443D1F Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1453-00443D1F Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1455-00405F2E Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1455-00405F2E Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1457-00406037 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1457-00406037 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1460-004061DF Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1460-004061DF Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1462-004062AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1462-004062AA Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1464-00443A5F Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1464-00443A5F Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1470-004065C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1470-004065C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1472-004067AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1472-004067AA Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1474-00406882 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1474-00406882 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1475-0040694B Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1475-0040694B Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1476-00406B1E Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1476-00406B1E Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1510-0042D8B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1510-0042D8B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1512-0041A13A Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1512-0041A13A Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1522-00419B43 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1522-00419B43 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1538-004269D2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1538-004269D2 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1541-00426BEB Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1541-00426BEB Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1556-0041E2AF Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1556-0041E2AF Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1588-0041F90B Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1588-0041F90B Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1607-004210FB Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1607-004210FB Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1668-00438A88 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1668-00438A88 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1679-0043810E Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1679-0043810E Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1683-00438461 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1683-00438461 Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1690-0043892F Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1690-0043892F Assembly shows XOR instruction xor eax ebp in Stream UID: 11999-1691-00438985 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11999-1691-004389852b:T4be,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption2c:T121b7,Found XOR loop in file "Patrial.dll" at offset 1725127; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1739129; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1741079; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1752671; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1756881; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1762163; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1764173; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1764985; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1765513; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1774185; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1774989; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1782975; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 1795895; code bytes = 30d0 Found XOR loop in file "Patrial.dll" at offset 440132; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 923201; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1010605; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1010734; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1717175; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1729053; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1741265; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1744835; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1752361; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1752877; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1753855; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 1755557; code bytes = 33c1 Found XOR loop in file "Patrial.dll" at offset 76934; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 189327; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 316108; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1198252; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1371964; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1384314; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1611252; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1717018; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1723352; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1723800; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1725088; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1731652; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1741342; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1743742; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1743918; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1756842; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1761856; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1764158; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1766754; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1769298; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1775642; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1798153; code bytes = 8030 Found XOR loop in file "Patrial.dll" at offset 1800034; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 244624; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 941923; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 950355; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 950519; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 956291; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 961811; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 968975; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 970705; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 971141; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 971663; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 972511; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 975273; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 975991; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 982561; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 983637; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 986703; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 990025; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 991743; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 995011; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 996463; code bytes = 30d0 Found XOR loop in file "Register.dll" at offset 949985; code bytes = 33c1 Found XOR loop in file "Register.dll" at offset 951583; code bytes = 33c1 Found XOR loop in file "Register.dll" at offset 991559; code bytes = 33c1 Found XOR loop in file "Register.dll" at offset 446656; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 903034; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 938516; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 940790; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 947412; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 948570; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 949498; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 950502; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 959062; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 961780; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 968966; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 975256; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 981068; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 986664; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 994992; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 996424; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 997267; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 1062812; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 1070312; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 1070559; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 1073539; code bytes = 8030 Found XOR loop in file "Register.dll" at offset 1080207; code bytes = 8030 Found XOR loop in file "RttHlp.exe" at offset 111873; code bytes = 30d0 Found XOR loop in file "RttHlp.exe" at offset 115385; code bytes = 30d0 Found XOR loop in file "RttHlp.exe" at offset 114873; code bytes = 33c1 Found XOR loop in file "RttHlp.exe" at offset 115346; code bytes = 8030 Found XOR loop in file "RttHlp.exe" at offset 120220; code bytes = 8030 Found XOR loop in file "RttHlp.exe" at offset 127720; code bytes = 8030 Found XOR loop in file "RttHlp.exe" at offset 127967; code bytes = 8030 Found XOR loop in file "RttHlp.exe" at offset 130947; code bytes = 8030 Found XOR loop in file "RttHlp.exe" at offset 137616; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 140803; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 450651; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 458693; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 461515; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 463141; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 515723; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 551624; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 554247; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 575166; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 579621; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 619089; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 633901; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 747699; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 799950; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 916371; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 980641; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1032826; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1104080; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1243494; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1362983; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1442360; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1669148; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1886112; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1931638; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1936252; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1954291; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1967960; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2004157; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2045511; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2061842; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2086047; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2090400; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2096079; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2096306; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2249613; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2256572; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2313423; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2399442; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2572351; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2582386; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2586191; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2657669; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2659819; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2833035; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2869746; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2931152; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2959869; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3022172; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3050550; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3070042; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3070273; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3187145; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3192246; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3198560; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3285391; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3448889; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3490717; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3508563; code bytes = 30d0 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 187327; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 458563; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 517149; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 585465; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 588917; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 591060; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 666458; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 684479; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 751982; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 752068; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 823444; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 828296; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 834068; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 947746; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 959988; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1042314; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1058585; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1109835; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1190237; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1209380; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1226337; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1241494; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1290055; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1384020; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1436037; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1458776; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1470240; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1520146; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1523097; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1624391; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1642491; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1673312; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1692783; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1708775; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1937922; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2106951; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2195905; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2255172; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2266344; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2292527; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2405374; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2471372; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2549332; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2557333; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2646653; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2652874; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2710412; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2715304; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2855426; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2997256; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3046266; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3180145; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3226877; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3435827; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3543518; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3600695; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3629511; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3710939; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3737898; code bytes = 33c1 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1307960; code bytes = 30040e Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 449464; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 458348; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 458690; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 460620; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 461476; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 481119; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 575892; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 678922; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 840908; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 864532; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1052391; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1118742; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1421476; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1576111; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 1704219; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2032364; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2113424; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2404679; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2469404; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2527640; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2635312; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2793288; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2828438; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2896740; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2933418; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 2957903; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3249317; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3252732; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3355109; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3472308; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3483738; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3621865; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3644361; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3750141; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3757903; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3769409; code bytes = 8030 Found XOR loop in file "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" at offset 3916732; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1724011; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1726493; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1728159; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1730319; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1731635; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1733343; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1734999; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1737387; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1745947; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1747421; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1750685; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1752059; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1752753; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1758087; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1761213; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1763189; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1764181; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1766443; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1770821; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1772237; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1779641; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1781459; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1782239; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1789643; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1790387; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1793467; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1796583; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1799867; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1805139; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1808315; code bytes = 30d0 Found XOR loop in file "vcl120.bpl" at offset 1735185; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1785619; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1806881; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1823431; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1827445; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1828983; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1833068; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 1837203; code bytes = 33c1 Found XOR loop in file "vcl120.bpl" at offset 84286; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 86979; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 104789; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 106968; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 113223; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 115588; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 167672; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 215374; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 230813; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 234356; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 251477; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 254395; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 261963; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 265705; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 343220; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 347524; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 351521; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 357183; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 362958; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 366821; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 369110; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 387554; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 394438; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 402487; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 412069; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 415936; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 521319; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 677257; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 677293; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 783396; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 824329; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 827407; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 832691; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 916320; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 961907; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 977078; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1004098; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1074286; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1124784; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1144191; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1275408; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1722296; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1726454; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1728120; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1730280; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1740910; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1754080; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1758048; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1761852; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1767558; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1769528; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1772218; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1773066; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1789604; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1793440; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1797552; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1799830; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1805132; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1808276; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1809283; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1809875; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 1996700; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 2004198; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 2004445; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 2007425; code bytes = 8030 Found XOR loop in file "vcl120.bpl" at offset 2014093; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 155282; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 155366; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 681160; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 997413; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 998639; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1008615; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1009629; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1010269; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1011213; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1014079; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1015427; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1026093; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1028223; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1028723; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1031699; code bytes = 30d0 Found XOR loop in file "rtl120.bpl" at offset 1003629; code bytes = 33c1 Found XOR loop in file "rtl120.bpl" at offset 1022649; code bytes = 33c1 Found XOR loop in file "rtl120.bpl" at offset 402323; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 659306; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 998616; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1002394; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1003454; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1007276; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1015404; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1019040; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1022058; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1026514; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1028700; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1030716; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1093532; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1101030; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1101277; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1104257; code bytes = 8030 Found XOR loop in file "rtl120.bpl" at offset 1110925; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A853277.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A853277.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A853277.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A853277.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 140803; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 450651; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 458693; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 461515; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 463141; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 515723; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 551624; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 554247; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 575166; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 579621; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 619089; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 633901; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 747699; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 799950; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 916371; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 980641; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1032826; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1104080; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1243494; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1362983; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1442360; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1669148; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1886112; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1931638; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1936252; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1954291; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1967960; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2004157; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2045511; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2061842; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2086047; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2090400; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2096079; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2096306; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2249613; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2256572; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2313423; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2399442; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2572351; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2582386; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2586191; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2657669; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2659819; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2833035; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2869746; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2931152; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2959869; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3022172; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3050550; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3070042; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3070273; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3187145; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3192246; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3198560; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3285391; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3448889; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3490717; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3508563; code bytes = 30d0 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 187327; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 458563; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 517149; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 585465; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 588917; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 591060; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 666458; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 684479; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 751982; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 752068; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 823444; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 828296; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 834068; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 947746; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 959988; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1042314; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1058585; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1109835; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1190237; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1209380; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1226337; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1241494; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1290055; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1384020; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1436037; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1458776; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1470240; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1520146; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1523097; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1624391; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1642491; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1673312; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1692783; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1708775; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1937922; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2106951; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2195905; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2255172; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2266344; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2292527; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2405374; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2471372; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2549332; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2557333; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2646653; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2652874; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2710412; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2715304; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2855426; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2997256; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3046266; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3180145; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3226877; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3435827; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3543518; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3600695; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3629511; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3710939; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3737898; code bytes = 33c1 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1307960; code bytes = 30040e Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 449464; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 458348; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 458690; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 460620; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 461476; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 481119; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 575892; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 678922; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 840908; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 864532; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1052391; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1118742; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1421476; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1576111; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 1704219; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2032364; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2113424; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2404679; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2469404; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2527640; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2635312; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2793288; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2828438; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2896740; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2933418; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 2957903; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3249317; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3252732; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3355109; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3472308; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3483738; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3621865; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3644361; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3750141; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3757903; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3769409; code bytes = 8030 Found XOR loop in file "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" at offset 3916732; code bytes = 8030 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 111873; code bytes = 30d0 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 115385; code bytes = 30d0 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 114873; code bytes = 33c1 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 115346; code bytes = 8030 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 120220; code bytes = 8030 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 127720; code bytes = 8030 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 127967; code bytes = 8030 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 130947; code bytes = 8030 Found XOR loop in file "RTTHLP.EXE.6A852764.bin" at offset 137616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 140803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 450651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 458693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 461515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 463141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 515723; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 554247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 575166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 579621; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 619089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 633901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 747699; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 799950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 916371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 980641; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1032826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1104080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1243494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1362983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1442360; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1669148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1886112; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1931638; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1936252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1954291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1967960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2004157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2045511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2061842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2086047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2090400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096079; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2096306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2249613; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2256572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2313423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2399442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2572351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2582386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2586191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2657669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2659819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2833035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2869746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2931152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2959869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3022172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3050550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3070042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3070273; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3187145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3192246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3198560; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3285391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3448889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3490717; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3508563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4028422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4161257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 187327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 458563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 517149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 585465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 588917; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 591060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 666458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 684479; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 751982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 752068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 823444; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 828296; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 834068; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 947746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 959988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1042314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1058585; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1109835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1190237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1209380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1226337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1241494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1290055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1436037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1458776; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1470240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1520146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1523097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1624391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1642491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1673312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1692783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1708775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1937922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2106951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2195905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2255172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2266344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2292527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2405374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2471372; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2549332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2557333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2646653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2652874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2710412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2715304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2855426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2997256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3046266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3180145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3226877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3435827; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3543518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3600695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3629511; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3710939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3737898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3980818; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4000394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4016008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4031510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4101175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4120755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4135013; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4141969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1307960; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 449464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 458348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 458690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 460620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 461476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 481119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 575892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 678922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 840908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 864532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1052391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1118742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1421476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1576111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1704219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2032364; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2113424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2404679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2469404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2527640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2635312; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2793288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2828438; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2896740; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2933418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2957903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3249317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3252732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3355109; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3472308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3483738; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3621865; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3644361; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3750141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3757903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3769409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3916732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3933888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4100901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4111094; code bytes = 80302d:T21cc,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000023040027c400370001000000000000000a00000008000000d06e3e00d06e3e00cb6e3e0000000000000000000000370000000001ecdd1d00020000006ce01d0095e136773efe6a00feffffff435c3a7750593a770010000008100000ca6e3e00c86e3e0001000000ee293a77010000000000000000000000180000000000000080d81d00249637776ce01d00a2e08565e88f0e1e18df1d00c89f3a7768bc406500000000000000004cdf1d0025c9346533c93465f8e3a87b010000007cdf1d000300000000000000081000006ce01d0068df1d00958d36650000370008000000 (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000600d3c005b0d3c0000000000000000000000370000000001ecd71d000000000050e51d0095e136773efe6a00feffffff435c3a7750593a77aa000000b80000005a0d3c00580d3c0074d91d00acdd1d0000000000640030006100340065006200640032003700350060170000000037001c5c397760d82875ffffffff1700000024d91d00240000000300000014de1d0040e31d00acdd1d008600000050d91d0096ed3a77820d3c00a06a10758600000074d91d00acdd1d000000000086008800a06a107574d91d00916c1075820d3c00a06a1075a06a1075e4dd1d0002020000 (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000b91200abc4002e0001000000000000000a00000008000000205a3500205a35001b5a3500000000000000000000002e00000000017cda210002000000fcdc210095e136779aeb6a00feffffff435c3a7750593a7700100000081000001a5a3500185a350001000000ee293a77010000000000000000000000180000000000000010d5210024963777fcdc2100a2e08565024d731ea8db2100c89f3a7768bc40650000000000000000dcdb210025c9346533c93465cc6bb07b010000000cdc2100030000000000000008100000fcdc2100f8db2100958d366500002e0008000000 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003800701938006b193800000000000000000000002e0000000001d0cf21000000000034dd210095e136779aeb6a00feffffff435c3a7750593a77aa000000b80000006a1938006819380058d1210090d521000000000000000000000000000000000000000000000000002018000000002e001c5c397760d82875ffffffff1700000008d121002400000003000000f8d5210024db210090d521008600000034d1210096ed3a7792193800a06a10758600000058d1210090d521000000000086008800a06a107558d12100916c107592193800a06a1075a06a1075c8d5210002020000 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005712) "RttHlp.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005792) "RttHlp.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000c8f312004cfa1200d4fa1200a2e0856544d24c0cfeffffffa80000000070c0010a00000094fa12006f9c8565000000000000000000000000200000005c42b3019cfa12006b42b30194fa1200b0f372026496b30101a1b301b0f37202ccfa1200ba2eb401c0fa12000d42b301a8000000c470c001f450b4016e30b3015d7bb3010b000000 (UID: 00000000-00005792) "RttHlp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001200b0287d0058f1120080f4777500007d000000000089f47775ba60d86902000000ccf11200c8f11200c0f01200c4f0120074f2120095e13677a3196a001cf11200c83a817590f11200d58c7975ccf1120060f1120042a47775a8028175a0f11200d2f47775080000006ef5777544f577754260d8690200000070aa6b6e0000130026bb6b6e74f11200020000000000130070aa6b6ea4f1120042a47775a8028175e8f1120010a96b6e08000000e6a86b6e49d4d0690200000070aa6b6e0000130026bb6b6ee4287d00b0287d00b4f112008050776e74f21200f9f26f6e498da907 (UID: 00000000-00005792) "RttHlp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005792) "RttHlp.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000a4d8d86954fe1200ee2d84650d0c000020fe120084f95c0184f95c01fe2d846588fe1200010000000000000000003f750000000074fe120000000000000000000000000088fe1200000000000000000000000000f0d8d8697cfe1200186d28757cfe12002a6d287500003f750000000000003f75e89a40001500160084f95c01a4fe120081c0836500003f7598743f758300000000003f7500003f750000000084f95c0100000000ccfe12004c000000e0710050d4fe1200ef710050ccfe12008300000090aa5f0101ff1200 (UID: 00000000-00005792)2e:T512,GetProcessHeap@KERNEL32.dll at 11999-2355-00439771 GetProcessHeap@KERNEL32.DLL at 00000000-00005648-14599-191-00C8394F GetProcessHeap@KERNEL32.DLL at 00000000-00005648-14599-192-00C83AF0 GetProcessHeap@KERNEL32.DLL at 00000000-00005648-14599-194-00C83B15 GetProcessHeap@KERNEL32.DLL at 00000000-00005648-14599-195-00C83A16 GetProcessHeap@KERNEL32.DLL at 00000000-00005648-14599-197-00C83BD3 OpenProcessToken@ADVAPI32.DLL at 00000000-00005648-14599-363-00CC0879 OpenProcess@KERNEL32.DLL at 00000000-00005648-14599-991-00C94B2A OpenProcessToken@ADVAPI32.DLL at 00000000-00005648-14599-1069-00C845EE GetProcessHeap@KERNEL32.DLL at 00000000-00005648-14599-1945-00CB9771 GetProcessHeap@KERNEL32.DLL at 00000000-00005712-16348-191-00C1394F GetProcessHeap@KERNEL32.DLL at 00000000-00005712-16348-192-00C13AF0 GetProcessHeap@KERNEL32.DLL at 00000000-00005712-16348-194-00C13B15 GetProcessHeap@KERNEL32.DLL at 00000000-00005712-16348-195-00C13A16 GetProcessHeap@KERNEL32.DLL at 00000000-00005712-16348-197-00C13BD3 OpenProcessToken@ADVAPI32.DLL at 00000000-00005712-16348-363-00C50879 OpenProcess@KERNEL32.DLL at 00000000-00005712-16348-991-00C24B2A OpenProcessToken@ADVAPI32.DLL at 00000000-00005712-16348-1069-00C145EE GetProcessHeap@KERNEL32.DLL at 00000000-00005712-16348-1945-00C497712f:T6a1,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{5D1B60D1-6B70-4699-B884-44C740C22E09}\ (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{5D1B60D1-6B70-4699-B884-44C740C22E09}\.cr (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\ (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\ (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00005712) "RttHlp.exe" called "CreateDirectoryW" with parameter %APPDATA%\IObit (UID: 00000000-00005792) "RttHlp.exe" called "CreateDirectoryW" with parameter %APPDATA%\IObit\Driver Booster (UID: 00000000-00005792) "RttHlp.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\IObit (UID: 00000000-00005792) "RttHlp.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\IObit\Driver Booster (UID: 00000000-00005792) "RttHlp.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\IObit\Driver Booster\License (UID: 00000000-00005792) "RttHlp.exe" called "CreateDirectoryW" with parameter %TEMP%\iobit-db-license-tmp (UID: 00000000-00005792) "RttHlp.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\IObit\IObitRtt (UID: 00000000-00005792)30:T11b3,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005712) "RttHlp.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crtdll.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Register.ENU (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Register.EN (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter pla.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter shdocvw.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter Register.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter SetupAPI.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter CfgMgr32.dll (UID: 00000000-00005792) "RttHlp.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005792)31:T4b1b,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005648) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005712) "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005712) "RttHlp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInfo (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetClassImageList (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiDestroyClassImageList (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetClassImageIndex (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiLoadClassIcon (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiDrawMiniIcon (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetClassDescriptionW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupOpenInfFileW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupCloseInfFile (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupFindFirstLineW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupFindNextLine (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupFindNextMatchLineW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupEnumInfSectionsW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupGetLineCountW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupGetIntField (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupGetBinaryField (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupGetStringFieldW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupGetSourceInfoW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupGetInfDriverStoreLocationW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetDevicePropertyW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInstanceIdW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CM_Locate_DevNodeW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CM_Reenumerate_DevNode (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CM_Get_Device_IDW (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CM_Get_Device_ID_Size (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter CM_Get_DevNode_Status (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005792) "RttHlp.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005792)32:T69c,MsgWaitForMultipleObjects at 11999-1504-0042DDA0 WaitForSingleObject@KERNEL32.dll at 11999-1599-00420D16 WaitForSingleObject@KERNEL32.dll at 11999-1607-004210FB Sleep@KERNEL32.DLL at 00000000-00005648-14599-342-00CC4102 WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-367-00CC0A28 Sleep@KERNEL32.DLL at 00000000-00005648-14599-588-00C82DBF Sleep@KERNEL32.DLL at 00000000-00005648-14599-770-00C954DC Sleep@KERNEL32.DLL at 00000000-00005648-14599-783-00C98CAC WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-799-00C969AE WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-805-00CAD43E WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-806-00CAD33E WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-807-00CAD259 WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-808-00CAD1B3 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005648-14599-868-00CA9DE1 Sleep@KERNEL32.DLL at 00000000-00005648-14599-901-00CC42FC Sleep@KERNEL32.DLL at 00000000-00005648-14599-918-00CC563F WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005648-14599-963-00C9EA7D WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005648-14599-964-00C9E645 WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-967-00C953E2 WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-969-00C9EA3E Sleep@KERNEL32.DLL at 00000000-00005648-14599-970-00C93F9B WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-984-00C9CF25 Sleep@KERNEL32.DLL at 00000000-00005648-14599-991-00C94B2A WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005648-14599-1004-00CA14E1 WaitForSingleObject@KERNEL32.DLL at 00000000-00005648-14599-1055-00CA15FE33:T7c8,"Patrial.dll" contains export function called "IIsBrowseAppPools" at ordinal 1 "Patrial.dll" contains export function called "IIsBrowseServer" at ordinal 2 "Patrial.dll" contains export function called "IIsDecodeBrowseResult" at ordinal 3 "Patrial.dll" contains export function called "OnIIsConfig" at ordinal 4 "Patrial.dll" contains export function called "OnIIsInstall" at ordinal 5 "Patrial.dll" contains export function called "OnIIsRemove" at ordinal 6 "Patrial.dll" contains export function called "OnIIsRollback" at ordinal 7 "Patrial.dll" contains export function called "OnIIsUninstall" at ordinal 8 "Register.dll" contains export function called "ActiveApp" at ordinal 10 "Register.dll" contains export function called "ActiveAppSpecial" at ordinal 9 "Register.dll" contains export function called "ActiveTrial" at ordinal 4 "Register.dll" contains export function called "CheckDbValue" at ordinal 1 "Register.dll" contains export function called "CheckLicenseLocatin" at ordinal 8 "Register.dll" contains export function called "CheckTrialInstalled" at ordinal 3 "Register.dll" contains export function called "ClearTrialData" at ordinal 2 "Register.dll" contains export function called "GetLicenseType" at ordinal 5 "Register.dll" contains export function called "GetSurplusDays" at ordinal 6 "Register.dll" contains export function called "ValidateThreadLicense" at ordinal 7 "vcl120.bpl" contains export function called "@$xp$11Forms@TForm" at ordinal 6178 "vcl120.bpl" contains export function called "@$xp$11Menus@TMenu" at ordinal 4544 "vcl120.bpl" contains export function called "@$xp$11TActiveForm" at ordinal 7131 "vcl120.bpl" contains export function called "@$xp$12Forms@TFrame" at ordinal 6206 "vcl120.bpl" contains export function called "@$xp$12Mask@Mask__2" at ordinal 6317 "vcl120.bpl" contains export function called "@$xp$12Tabs@TTabSet" at ordinal 7966 "vcl120.bpl" contains export function called "@$xp$13Forms@TScreen" at ordinal 617134:T3a26,"SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00005648.00000000.77738.00CCB000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005712.00000000.77908.002E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00005712.00000000.77908.00C5B000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005712.00000001.78366.002E0000.00000004.mdmp "!\Registry\Machine\Software\Classes\CLSID" in Source: 00000000-00005792.00000000.78110.00210000.00000004.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00005792.00000000.78110.00210000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 403040" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 403040" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 545110" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 545110" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 735360" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 735360" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 920490" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 920490" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 5_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 6_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 7_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 8_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare 9_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare Beta_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Booster_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Booster Beta_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag 4 pro_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag 3 pro_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag 2 pro_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag 4_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag 3_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag 2_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Defrag_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObitUninstall" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\Uninstaller" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\ASC" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare Ultimate_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\ASCU" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\Driver Booster" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Malware Fighter_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\IObit Malware Fighter" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IOTransfer Beta_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IOTransfer\IOT Beta" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IOTransfer_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IOTransfer\IOT" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Game Booster_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\PCGameBoost\Smart Game Booster" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit Software Updater_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\IObit Software Updater" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GetInsta_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\GetInsTa" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iTop VPN_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\iTop VPN" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iTop Screen Recorder_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\iTop Screen Recorder" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iTop Screenshot_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\iTop Screenshot" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IObit SysInfo_is1" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\IObit SysInfo" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\Advanced SystemCare" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "SOFTWARE\IObit\Advanced SystemCare Ultimate" in Source: 00000000-00005792.00000000.78110.00401000.00000020.mdmp "System\CurrentControlSet\Services\SysmonLog" in Source: 00000000-00005792.00000001.78360.00287000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows nt\currentversion\appcompatflags\AIT" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\Windows\Appcompat\" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Services" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\REGISTRY\MACHINE\System\CurrentControlSet\Control\Session Manager\Subsystems\CSRSS" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\Safe Load Prefixes" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Srp\GP\DLL" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\WMR" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\Windows Error Reporting\Escalation" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Software\Microsoft\Windows" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledProcesses\" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\CommonDatapoints\" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\DisabledSessions\" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Microsoft\SQMClient\Windows\AdaptiveSqm\Throttling" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\CMF\SQMData\BootLanguages" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\NLS\Language" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CustomLocale" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\MUI\UILanguages\PendingDelete" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "\Registry\Machine\Software\Policies\Microsoft\MUI\Settings" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Software\Policies\Microsoft\Control Panel\Desktop" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00005792.00000001.78360.02D00000.00000004.mdmp35:Tbb7,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 65340000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "OLE32.DLL" at base 76d20000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "PROFAPI.DLL" at base 75260000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "OLEAUT32.DLL" at base 756d0000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "FECLIENT.DLL" at base 6c900000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75100000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "CABINET.DLL" at base 714e0000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b00000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76d20000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77040000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75370000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 718e0000 "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" loaded module "KERNEL32" at base 76b00000 "RttHlp.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ef0000 "RttHlp.exe" loaded module "CRYPTBASE.DLL" at base 75150000 "RttHlp.exe" loaded module "DWMAPI.DLL" at base 73920000 "RttHlp.exe" loaded module "ADVAPI32.DLL" at base 76c70000 "RttHlp.exe" loaded module "%WINDIR%\SYSTEM32\CRTDLL.DLL" at base 6c240000 "RttHlp.exe" loaded module "DBGHELP.DLL" at base 6e6b0000 "RttHlp.exe" loaded module "RPCRT4.DLL" at base 755b0000 "RttHlp.exe" loaded module "PLA.DLL" at base 65680000 "RttHlp.exe" loaded module "MSVCRT.DLL" at base 75770000 "RttHlp.exe" loaded module "SHDOCVW.DLL" at base 6ff50000 "RttHlp.exe" loaded module "USER32.DLL" at base 76f70000 "RttHlp.exe" loaded module "OLE32.DLL" at base 76d20000 "RttHlp.exe" loaded module "PROFAPI.DLL" at base 75260000 "RttHlp.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76b00000 "RttHlp.exe" loaded module "SETUPAPI.DLL" at base 76960000 "RttHlp.exe" loaded module "CFGMGR32.DLL" at base 753f0000 "RttHlp.exe" loaded module "KERNEL32.DLL" at base 76b00000 "RttHlp.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 774a0000 "RttHlp.exe" loaded module "OLEAUT32.DLL" at base 756d000036:Tb92,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf" was detected as "WiX Toolset installer" and name: "Installer" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf" was detected as "Microsoft Visual C/C++" and name: "Compiler" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf" was detected as "Microsoft Cabinet File" and name: "Archive" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf" was detected as "Microsoft Linker" and name: "Linker" "Patrial.dll" was detected as "WiX Toolset installer" and name: "Installer" "Patrial.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Patrial.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "Patrial.dll" was detected as "Microsoft Linker" and name: "Linker" "Register.dll" was detected as "WiX Toolset installer" and name: "Installer" "Register.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Register.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "Register.dll" was detected as "Microsoft Linker" and name: "Linker" "RttHlp.exe" was detected as "WiX Toolset installer" and name: "Installer" "RttHlp.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "RttHlp.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "RttHlp.exe" was detected as "Microsoft Linker" and name: "Linker" "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" was detected as "WiX Toolset installer" and name: "Installer" "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" was detected as "Microsoft Linker" and name: "Linker" "vcl120.bpl" was detected as "WiX Toolset installer" and name: "Installer" "vcl120.bpl" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vcl120.bpl" was detected as "Microsoft Cabinet File" and name: "Archive" "vcl120.bpl" was detected as "Microsoft Linker" and name: "Linker" "rtl120.bpl" was detected as "WiX Toolset installer" and name: "Installer" "rtl120.bpl" was detected as "Microsoft Visual C/C++" and name: "Compiler" "rtl120.bpl" was detected as "Microsoft Cabinet File" and name: "Archive" "rtl120.bpl" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6A853277.bin" was detected as "WiX Toolset installer" and name: "Installer" "DISMHOST.EXE.6A853277.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A853277.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6A853277.bin" was detected as "Microsoft Linker" and name: "Linker"37:Tb7a,Found string "Write-Output "ERROR: $($_.Exception.Message)"" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "$errVar = New-Object System.Collections.ArrayList" (Indicator: "New-Object"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "$logVar = New-Object System.Collections.ArrayList" (Indicator: "New-Object"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output 'Dumping Publish Log to TempLogFile...'" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output 'Dumping Errors to TempErrorFile...'" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output ('Error Count = ' + $errVar.Count)" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output $aErrMessage" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output $aOkMessage" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "if ( Test-Path $aParamFilePath )" (Indicator: "Test-Path"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "if ( Test-Path $aDestSettingsFilePath )" (Indicator: "Test-Path"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output 'Running non-invasive Test-Publish ...'" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output 'Publishing package ...'" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output '!!! An exception has been caught !!!'" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp") Found string "Write-Output $_.Exception.Message" (Indicator: "Write-Output"; Source: "00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp")38:T193f,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf" file has an entrypoint instructions - "call 0x42e7c5,jmp 0x42e13e,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x42e2c9,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp cl, 0x40,jae 0x42e30a,cmp cl, 0x20,jae 0x42e300,shrd eax, edx, cl,shr edx, cl,ret ,mov eax, edx,xor edx, edx,and cl, 0x1f,shr eax, cl,ret ," "Patrial.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100e1c1d,call 0x100e2245,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100e1ad9,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,bnd ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,bnd call 0x100e0f9a,bnd jmp 0x100e1c32,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax," "Register.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x40,mov eax, 0x4d6164,call 0x4084a4,mov eax, 0x4d6118,mov dword ptr [0x4e7b54], eax,mov eax, 1,call 0x4d6118,call 0x404e18,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RttHlp.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,mov ecx, 9,push 0,push 0,dec ecx,jne 0x4159a0,push ebx,push esi,push edi,mov eax, 0x414640,call 0x4012e4,xor eax, eax,push ebp,push 0x415ef3,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor eax, eax,push ebp,push 0x415ece,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 0,push 0,push 0,mov cl, 4,mov dl, 1,mov eax, dword ptr [0x40f020],call 0x40fc88,mov dword ptr [0x418788], eax,lea edx, [ebp - 0x1c],xor eax, eax,call 0x401028,mov eax, dword ptr [ebp - 0x1c],lea edx, [ebp - 0x18]," "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" file has an entrypoint instructions - "call 0x42e7c5,jmp 0x42e13e,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x42e2c9,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp cl, 0x40,jae 0x42e30a,cmp cl, 0x20,jae 0x42e300,shrd eax, edx, cl,shr edx, cl,ret ,mov eax, edx,xor edx, edx,and cl, 0x1f,shr eax, cl,ret ," "vcl120.bpl" file has an entrypoint instructions - "jmp 0x50121600,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "rtl120.bpl" file has an entrypoint instructions - "jmp 0x5000da30,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6A853277.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"39:Tb0b,"Patrial.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Patrial.dll]- [targetUID: 00000000-00005712] "Register.dll" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 8 sections"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Register.dll]- [targetUID: 00000000-00005712] "RttHlp.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 7 sections"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\RttHlp.exe]- [targetUID: 00000000-00005712] "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- [targetUID: N/A] "vcl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\vcl120.bpl]- [targetUID: 00000000-00005712] "rtl120.bpl" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\rtl120.bpl]- [targetUID: 00000000-00005712] "hypha.rpm" has type "data"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\hypha.rpm]- [targetUID: 00000000-00005712] "squirearch.db" has type "DIY-Thermocam raw data (Lepton 2.x) scale 68-119 spot sensor temperature 36893488147419103232.000000 unit celsius color scheme 0 calibration: offset 17756097975589866003496960.000000 slope 605975542821358770585600.000000"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\squirearch.db]- [targetUID: 00000000-00005712] "DISMHOST.EXE.6A853277.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "BootstrapperApplicationData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (471) with CRLF line terminators"- Location: [%WINDIR%\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\BootstrapperApplicationData.xml]- [targetUID: 00000000-00005712] "Breakdown_20260819034716.log" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\Breakdown_20260819034716.log]- [targetUID: 00000000-00005712] "DBRtt.ept" has type "data"- Location: [%ALLUSERSPROFILE%\IObit\IObitRtt\DBRtt.ept]- [targetUID: 00000000-00005792] "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%WINDIR%\Temp\{5D1B60D1-6B70-4699-B884-44C740C22E09}\.cr\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe]- [targetUID: 00000000-00005712] "RTTHLP.EXE.6A852764.bin" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 7 sections"- [targetUID: N/A]3a:Tbc6,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3b:T10c8,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "WIN31FILESYSTEM"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\MSXML2.DOMDOCUMENT\CLSID"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDPROCESSES"; Key: "D7EA099D"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS"; Key: "MACHINETHROTTLING"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS"; Key: "GLOBALSESSION"; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\PROGID"; Key: ""; Value: "") "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}"; Key: ""; Value: "")3c:T472,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware3d:T973,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "\Device\KsecDD" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\Msi.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\FLTLIB.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\MSVCP140.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\VCRUNTIME140.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll"3e:T669,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{5D1B60D1-6B70-4699-B884-44C740C22E09}\.cr\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Patrial.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\hypha.rpm" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Register.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\rtl120.bpl" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\RttHlp.exe" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\squirearch.db" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\vcl120.bpl" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" touched file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\BootstrapperApplicationData.xml"3f:Tc66,"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\FLTLIB.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\MSVCP140.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\ucrtbase.DLL" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll"40:T858,"RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\RttHlp.exe.Local\" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\winspool.drv" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\rtl120.ENU" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\rtl120.EN" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\vcl120.ENU" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\vcl120.EN" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Register.ENU" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\Register.EN" "RttHlp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\IObit" "RttHlp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\IObit\Driver Booster\Config.ini" "RttHlp.exe" trying to access non-existent file "C:\ProgramData\IObit" "RttHlp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\iobit-db-license-tmp\" "RttHlp.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\iobit-db-license-tmp" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\local.dat" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\lang.dat" "RttHlp.exe" trying to access non-existent file "C:\ProgramData\IObit\IObitRtt" "RttHlp.exe" trying to access non-existent file "C:\ProgramData\IObit\IObitRtt\DBRtt.ept" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\RTTHLP.EXE.LOCAL" "RttHlp.exe" trying to access non-existent file "C:\Windows\Temp\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\.ba\WINSPOOL.DRV"41:T2b06,Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dllr9wq];w*g?mu(gmu" - Source: "00000000-00005648.00000000.77738.00CCB000.00000002.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dllr9wq];w*g?mu(gmu" - Source: "00000000-00005712.00000000.77908.00C5B000.00000002.mdmp") Found URL "http://www.w3.org/1999/xsl/transform'" - Source: "00000000-00005792.00000000.78110.00210000.00000004.mdmp") Found URL "https://www.iobit.com/appgoto.php?https://www.iobit.com/appgoto.php?to=indexhttps://www.iobit.com/appgoto.php?to=downloadhttps://www.iobit.com/appgoto.php?to=dbproducthttps://www.iobit.com/appgoto.php?to=comparehttps://www.iobit.com/appgoto.php?to=usermanualhttps://www.iobit.com/appgoto.php?to=feedbackhttps://www.iobit.com/appgoto.php?to=faqhttps://www.iobit.com/appgoto.php?to=updatehttps://www.iobit.com/appgoto.php?to=proupdatehttps://www.iobit.com/appgoto.php?to=othupdatehttps://www.iobit.com/appgoto.php?to=othupdatehttps://www.iobit.com/appgoto.php?to=purchasehttps://www.iobit.com/appgoto.php?to=purchase-%dhttps://www.iobit.com/appgoto.php?to=htmlfailedhttps://www.iobit.com/appgoto.php?to=featurehttps://www.iobit.com/appgoto.php?to=bannerbuyhttps://www.iobit.com/appgoto.php?to=bannerbuybtmhttps://www.iobit.com/appgoto.php?to=activatewebhttps://www.iobit.com/appgoto.php?to=activateweb-%dhttps://www.iobit.com/appgoto.php?to=expiredhttps://www.iobit.com/appgoto.php?to=gaexpiredhttps://www.iobit.com/appgoto.php?to=multipcexpiredhttps://www.iobit.com/appgoto.php?to=regexpiredhttps://www.iobit.com/appgoto.php?to=reggaexpiredhttps://www.iobit.com/appgoto.php?to=regovermaxhttps://www.iobit.com/appgoto.php?to=regovermaxgahttps://www.iobit.com/appgoto.php?to=revokedkeyhttps://www.iobit.com/appgoto.php?to=lostcodehttps://www.iobit.com/appgoto.php?to=helphttps://www.iobit.com/appgoto.php?to=helptranslatehttps://www.iobit.com/appgoto.php?to=filerupthttps://www.iobit.com/appgoto.php?to=vertooldhttps://www.iobit.com/appgoto.php?to=installhttps://www.iobit.com/appgoto.php?to=unplughttps://www.iobit.com/appgoto.php?to=gacomphttps://www.iobit.com/appgoto.php?to=reinstallhttps://www.iobit.com/appgoto.php?to=lostcodehttps://www.iobit.com/appgoto.php?to=garegionhttps://www.iobit.com/appgoto.php?to=expophttps://www.iobit.com/appgoto.php?to=nosoundcrsthttps://www.iobit.com/appgoto.php?to=boostaschttps://www.iobit.com/appgoto.php?to=trialbuyhttps://www.iobit.com/appgoto.php?to=ncupdatehttps://www.iobit.com/appgoto.php?to=likefbhttps://www.iobit.com/appgoto.php?to=forumhttps://www.iobit.com/appgoto.php?to=boostaschttps://www.iobit.com/appgoto.php?to=regvermismatchhttps://forums.iobit.com/forum/driver-booster/driver-booster-11https://www.iobit.com/feedback/db/feedback.phphttp://idb.iobit.com/check.phphttps://s1.driverboosterscan.com/worker.phphttps://s1.driverboosterscan.com/worker.phphttps://s2.driverboosterscan.com/worker.phphttp://www.cd4o.com/drivers/wlst/v.jsonhttp://www.cd4o.com/drivers/wlst/v.jsonhttp://www.cd4o.com/drivers/http://www.cd4o.com/drivers/http://www.iobit.com/goto.php?id=dbsurveyhttp://stats.iobit.com/usage.phphttp://ascstats.iobit.com/active.phphttp://updatestats.cd4o.com/api.php?act=updatehttp://ascstats.iobit.com/other/insert.phphttp://ascstats.iobit.com/other/db_extlink_download.phphttp://ascstats.iobit.com/other/db_temp_download.phphttp://ascstats.iobit.com/other/db_driverinstall.phphttp://ascstats.iobit.com/other/db_dchinststat.phphttps://www.facebook.com/iobitsofthttps://twitter.com/iobitsofthttp://www.iobit.com/goto.php?id=plusgp01_dbhttp://jp.iobit.com/rd/db-download-aschttp://jp.iobit.com/rd/db-download-isumm/dd/yyyy" - Source: "00000000-00005792.00000000.78110.00401000.00000020.mdmp") Found URL "http://www.cd4o.com/drivers/http://www.iobit.com/cloud/db/index.phpdownload.iobit.comiobitdriver" - Source: "00000000-00005792.00000000.78110.00401000.00000020.mdmp") Found URL "http://www.iobit.com/http://www.iobit.com/goto.php?id=likefb01_dbhttp://www.iobit.com/driver-booster-pro.phphttps://www.facebook.com/iobitsofthttps://twitter.com/iobitsofthttp://www.iobit.com/goto.php?id=plusgp01_dbhttp://forums.iobit.com/showthread.php?t=16792http://www.iobit.com/faq.php?product=dbhttp://www.iobit.com/productfeedback.php?product=driver-boosterhttp://www.iobit.com/install/db/index.phphttp://www.iobit.com/compare/db/index.phphttp://www.iobit.com/goto.php?id=dbsurveyhttps://www.iobit.com/appgoto.php?to=usermanualhttp://update.iobit.com/infofiles/db2/freeware-db.upthttp://update.iobit.com/infofiles/db2/db2_pro.upthttp://update.iobit.com/infofiles/db2/db2_free.upthttp://update.iobit.com/infofiles/db2/db2_oth.upthttp://update.iobit.com/infofiles/db6/db6_pro.upthttp://www.iobit.com/goto.php?id=dbproregisterhttp://idb.iobit.com/check.phphttp://www.iobit.com/lostcode.phphttp://www.iobit.com/hotquestions-db.php2ec72-368a4-5e4e9-d54a1a3ddc-13ad6-c8b24-85cb9d2b02-dd3b0-6ef1a-8a1b9c71de-50ec8-6afa0-d20b90b635-e0aa7-970c1-a5bb9dd3c0-bbd23-c9310-d30b93c736-bd10a-be875-9bcb9ea5ca-755f5-a07bc-f29f1ef133-57287-a3387-de5b90187e-b9764-4d9fa-211b21713c-50a83-f5ee1-c62b271814-efe6d-6f740-739b2dc5b1-f9ef3-626b9-384b228d19-ffa92-b1c77-c5db25bc56-2208e-0b0b1-b3bb20e666-956fd-c1363-1e4a1c785f-7d5c0-6201a-fe3f45d5bf-cbc8b-6a5b0-29ff4befc7-782ad-edc3a-3f6f4f6270-27561-bd778-486f498a4e-ec7e7-4f113-d92f453a66-5d157-a79bc-356f43301a-ae685-d9d9c-043f4update\update.iniupdate\update.iniiobit\driver" - Source: "00000000-00005792.00000000.78110.00401000.00000020.mdmp") Found URL "http://stats.iobit.com/active_month.php" - Source: "00000000-00005792.00000000.78110.00401000.00000020.mdmp") Found URL "http://c0rl.m/products/g" - Source: "00000000-00005792.00000000.78110.01940000.00000004.mdmp") Found URL "http://crl3.digicert/assured-cs-g1.0c07wwwkv0t0$!1idcodesigningg]" - Source: "00000000-00005792.00000000.78110.01940000.00000004.mdmp") Found URL "http://crl4.digicert.com/d0assuredidrootcj-" - Source: "00000000-00005792.00000000.78110.01940000.00000004.mdmp") Found URL "http://www.info-zip.org/" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "ftp://ftp.info-zip.org/pub/infozip,the" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0g" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0g]" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "https://www.digicert.com/cps0azm$v0t082http://crl3.digicert.com/digicertassuredidca-1.crl082http://crl4.digicert.com/digicertassuredidca-1.crl0wk0i0$http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicertassuredidca-1.crt0iw!]4/(o:r" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0digicert" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "http://www.vmware.com/0t" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "http://sv.symcb.com/sv.crl0az0x0v0l0" - Source: "00000000-00005792.00000000.78110.02BE0000.00000004.mdmp") Found URL "https://d.symcb.com/cps0%https://d.symcb.com/rpa0k0i0http://sv.symcd.com0&http://sv.symcb.com/sv.crt0-o6%1*c1rmv))e" (Indicator: "GetDC"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004052.00000000.67284.025A0000.00000004.mdmp")4c:T54e,Spawned process "b1ad5aa40c89bce3ed9d22762085fb2b.exe" (UID: 00000000-00007760) Spawned process "b1ad5aa40c89bce3ed9d22762085fb2b.exe" with commandline "-burn.clean.room="C:\\b1ad5aa40c89bce3ed9d22762085fb2b.exe" -burn.filehandle.attached=612 -burn.filehandle.self=632" (UID: 00000000-00004140) Spawned process "RttHlp.exe" (UID: 00000000-00006584) Spawned process "RttHlp.exe" (UID: 00000000-00004052) Spawned process "cmd.exe" (UID: 00000000-00004988) Spawned process "explorer.exe" (UID: 00000000-00007268) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 7268 -ip 7268" (UID: 00000000-00003840) Spawned process "WerFault.exe" with commandline "-u -p 7268 -s 744" (UID: 00000000-00006312) Spawned process "WerFault.exe" with commandline "-u -p 7268 -s 744" (UID: 00000000-00003352) Spawned process "RttHlp.exe" (UID: 00000000-00000184) Spawned process "cmd.exe" (UID: 00000000-00007112) Spawned process "explorer.exe" (UID: 00000000-00004308) Spawned process "WerFault.exe" with commandline "-pss -s 364 -p 4308 -ip 4308" (UID: 00000000-00004712) Spawned process "WerFault.exe" with commandline "-u -p 4308 -s 760" (UID: 00000000-00007360) Spawned process "WerFault.exe" with commandline "-u -p 4308 -s 760" (UID: 00000000-00007332) Spawned process "WerFault.exe" with commandline "-u -p 4308 -s 760" (UID: 00000000-00007616)4d:T858,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGB0lEQVR4XsWXWWyUVRTHh7IVyiLQlZ2yFIiCUAV8EuVBfREMPikGoeKLxkYT1wiiiUl90EQwLhBUqC2lDEsKWCjUsqRAiMECgkqxxgSBCAE6072S4//3dW795mtpywNxkn/mzr3n/M9y7zn3TijUzad64kRrzcqyf6ZOtVvTptkt990FkEUH3SDfHX+uTpnSI6Me/HIaoxvk6/ZTEQpZZPJkq1cEjUJrT413AnSbxBGVI1F9n580qXuHMB6M+Jrmzk2YYBVjx9qWkSNtfXq6fZqaah/HwJg51pBBFh1PHy4gByJdOeAij4s4Nj6fmWlhka8cPtwWJSXZ7P79bVzv3pbSq5cHxsyxhgyy6Pg5+IYbG9gK2g9FnKcSblDKrgunFMn2UaPso5QUyxkyxBYMGGBZfftaSkKCJYqkdwyMmWMNGWTzkpMtLN0qccDVoAw4R3AiaD/EnrvIb0ihRun6JiPDnh40yGb06+cZGChDfYWETiJgjjVkkiV7r5xZJN0N2poaVQNOOH5sBfVDjS4DApF/LeMrhg616SK6R4RE6mRH6PecxER7TCkHczVmzq3jzFBtDRl5QRxwwen4seVkQxe0V5QLdes8JO2LBw+2aSIYJKJgxGTkXaV4o/YarNSYOb8MOknSJQC44HT82MKm1yds+vT2hWua5PCw5/eJMJ2DBhQdaU0TRur3k0rtJhGeUFQgX2PmWEuNyaKDboYAF5xwY6P9ULIVngOx1JyNnfYcpQ2CNJR1urMFTvk8pXr+wIH2mk56+bhx9qcOE2D8quYe1hrbgSw66MIBF5xwY8PZo2OGzFcq1PCqESNsgYgGKIXs4bNSzB02zN7U/HtK9Yeq+c2K+Bcd0hvSA4wLNcfaKskgiw66cMAFJ9zY8JdnnANbREIto9RHSkS7VgeoTEo/yfPfZOi8Ir6oNEYk36zsAcbMsfarZJBFB1044IITbmy0O+BlwHcG6GaztV/sYS8pcdI5bLvHjLEr2q8WybYKf2t8UkYOjh/vgTFzrCGDLDrowgEXnHBjw9lry4DPAVrq2IS2JsNJRmmm9vEdpe6cImuMRfyjDK4W+RKlGDBmjrUGAVl00IUDLjjhxka8A74f9HVaq6t5GgtluFRGTqpkIMfID4p6ibrdDBkAjJljrV5AFh10ST9ccKbqNzb+FwfgytDvT/wOBM/A3dwCWnSmSnJNhwz4HLhbh5CuSC/IDh5CMnCiosKOHz9ux44etcrKSjty5IgdPnTYDh08aBVaKy8vtwP7D9j+sjLbt3ef7Q2HvZKLigBjgPFftFaVIaV6uzJcqDIs8pchGcB4a2trj/H9nj1WNHq0VctQVCRc44yLNZen9K5Wy/UakTpjl43IZYDIIW5sbLSfL1yxBbnFNvfFgg5oaGjw5Hbv2mWvi+iwUn9ZUV8SGL8R66AP6T0wW2nPFnrUikm7cwCcuXDZHn2lyOas2BQHHGhpabGSkhJ7ShcPWagSGdisMXOjZQyD/suIC43LKO92lxF7HnTgkZcL7MGcb+NQX1/vObBzx06bKcL3RUj/514g7cxx2t3HXcdc6VzH2zq5jnkKhDhwzoEz1Zds/kv59sDyDfFYtsHq6uqsubnZdmzf7kVIqp/QoQLzNHbl5owHHyQ8zVzq4x4knHbnQE5eiWUvW98Rz6+3aDTqObBNVRB8oPDp8CRTRnr0JKPUcODq9VqbtfSrGL70EC4/7YFxJBKxpqYmCxcXe8+v/qG2ByklhlH/o3Q5j1Jty20fpf4MUOc4UHPxqt3/3BftCJef8tJO5MX7q6y2ttZzoLhoi83S6R4Te5bzSsrs08d7hCxUxDzLt97Js5wm47bg8dyNNnPJZ7b4rcJ240SO8Zs3b3oOFBVutnW+Pyb09rVpaW1/TBQxdX72Tv6Y0OFwAPLKUzU245k1tvSDrd6p9zsBcLKwoOC/RtINiJjUd/nXjPbquhxlduz0H/b256XegcMpB1em3+XndzDUDl+6AVkI2uvwKS0t9dorHY4mQ51Tapx2Dhx7TtqJHOP569YZVziXWKdwa/r+XVsRtBf8/AvFvVQYv1p10QAAAABJRU5ErkJggg==4e:T858,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGB0lEQVR4XsWXWWyUVRTHh7IVyiLQlZ2yFIiCUAV8EuVBfREMPikGoeKLxkYT1wiiiUl90EQwLhBUqC2lDEsKWCjUsqRAiMECgkqxxgSBCAE6072S4//3dW795mtpywNxkn/mzr3n/M9y7zn3TijUzad64kRrzcqyf6ZOtVvTptkt990FkEUH3SDfHX+uTpnSI6Me/HIaoxvk6/ZTEQpZZPJkq1cEjUJrT413AnSbxBGVI1F9n580qXuHMB6M+Jrmzk2YYBVjx9qWkSNtfXq6fZqaah/HwJg51pBBFh1PHy4gByJdOeAij4s4Nj6fmWlhka8cPtwWJSXZ7P79bVzv3pbSq5cHxsyxhgyy6Pg5+IYbG9gK2g9FnKcSblDKrgunFMn2UaPso5QUyxkyxBYMGGBZfftaSkKCJYqkdwyMmWMNGWTzkpMtLN0qccDVoAw4R3AiaD/EnrvIb0ihRun6JiPDnh40yGb06+cZGChDfYWETiJgjjVkkiV7r5xZJN0N2poaVQNOOH5sBfVDjS4DApF/LeMrhg616SK6R4RE6mRH6PecxER7TCkHczVmzq3jzFBtDRl5QRxwwen4seVkQxe0V5QLdes8JO2LBw+2aSIYJKJgxGTkXaV4o/YarNSYOb8MOknSJQC44HT82MKm1yds+vT2hWua5PCw5/eJMJ2DBhQdaU0TRur3k0rtJhGeUFQgX2PmWEuNyaKDboYAF5xwY6P9ULIVngOx1JyNnfYcpQ2CNJR1urMFTvk8pXr+wIH2mk56+bhx9qcOE2D8quYe1hrbgSw66MIBF5xwY8PZo2OGzFcq1PCqESNsgYgGKIXs4bNSzB02zN7U/HtK9Yeq+c2K+Bcd0hvSA4wLNcfaKskgiw66cMAFJ9zY8JdnnANbREIto9RHSkS7VgeoTEo/yfPfZOi8Ir6oNEYk36zsAcbMsfarZJBFB1044IITbmy0O+BlwHcG6GaztV/sYS8pcdI5bLvHjLEr2q8WybYKf2t8UkYOjh/vgTFzrCGDLDrowgEXnHBjw9lry4DPAVrq2IS2JsNJRmmm9vEdpe6cImuMRfyjDK4W+RKlGDBmjrUGAVl00IUDLjjhxka8A74f9HVaq6t5GgtluFRGTqpkIMfID4p6ibrdDBkAjJljrV5AFh10ST9ccKbqNzb+FwfgytDvT/wOBM/A3dwCWnSmSnJNhwz4HLhbh5CuSC/IDh5CMnCiosKOHz9ux44etcrKSjty5IgdPnTYDh08aBVaKy8vtwP7D9j+sjLbt3ef7Q2HvZKLigBjgPFftFaVIaV6uzJcqDIs8pchGcB4a2trj/H9nj1WNHq0VctQVCRc44yLNZen9K5Wy/UakTpjl43IZYDIIW5sbLSfL1yxBbnFNvfFgg5oaGjw5Hbv2mWvi+iwUn9ZUV8SGL8R66AP6T0wW2nPFnrUikm7cwCcuXDZHn2lyOas2BQHHGhpabGSkhJ7ShcPWagSGdisMXOjZQyD/suIC43LKO92lxF7HnTgkZcL7MGcb+NQX1/vObBzx06bKcL3RUj/514g7cxx2t3HXcdc6VzH2zq5jnkKhDhwzoEz1Zds/kv59sDyDfFYtsHq6uqsubnZdmzf7kVIqp/QoQLzNHbl5owHHyQ8zVzq4x4knHbnQE5eiWUvW98Rz6+3aDTqObBNVRB8oPDp8CRTRnr0JKPUcODq9VqbtfSrGL70EC4/7YFxJBKxpqYmCxcXe8+v/qG2ByklhlH/o3Q5j1Jty20fpf4MUOc4UHPxqt3/3BftCJef8tJO5MX7q6y2ttZzoLhoi83S6R4Te5bzSsrs08d7hCxUxDzLt97Js5wm47bg8dyNNnPJZ7b4rcJ240SO8Zs3b3oOFBVutnW+Pyb09rVpaW1/TBQxdX72Tv6Y0OFwAPLKUzU245k1tvSDrd6p9zsBcLKwoOC/RtINiJjUd/nXjPbquhxlduz0H/b256XegcMpB1em3+XndzDUDl+6AVkI2uvwKS0t9dorHY4mQ51Tapx2Dhx7TtqJHOP569YZVziXWKdwa/r+XVsRtBf8/AvFvVQYv1p10QAAAABJRU5ErkJggg==4f:T858,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGB0lEQVR4XsWXWWyUVRTHh7IVyiLQlZ2yFIiCUAV8EuVBfREMPikGoeKLxkYT1wiiiUl90EQwLhBUqC2lDEsKWCjUsqRAiMECgkqxxgSBCAE6072S4//3dW795mtpywNxkn/mzr3n/M9y7zn3TijUzad64kRrzcqyf6ZOtVvTptkt990FkEUH3SDfHX+uTpnSI6Me/HIaoxvk6/ZTEQpZZPJkq1cEjUJrT413AnSbxBGVI1F9n580qXuHMB6M+Jrmzk2YYBVjx9qWkSNtfXq6fZqaah/HwJg51pBBFh1PHy4gByJdOeAij4s4Nj6fmWlhka8cPtwWJSXZ7P79bVzv3pbSq5cHxsyxhgyy6Pg5+IYbG9gK2g9FnKcSblDKrgunFMn2UaPso5QUyxkyxBYMGGBZfftaSkKCJYqkdwyMmWMNGWTzkpMtLN0qccDVoAw4R3AiaD/EnrvIb0ihRun6JiPDnh40yGb06+cZGChDfYWETiJgjjVkkiV7r5xZJN0N2poaVQNOOH5sBfVDjS4DApF/LeMrhg616SK6R4RE6mRH6PecxER7TCkHczVmzq3jzFBtDRl5QRxwwen4seVkQxe0V5QLdes8JO2LBw+2aSIYJKJgxGTkXaV4o/YarNSYOb8MOknSJQC44HT82MKm1yds+vT2hWua5PCw5/eJMJ2DBhQdaU0TRur3k0rtJhGeUFQgX2PmWEuNyaKDboYAF5xwY6P9ULIVngOx1JyNnfYcpQ2CNJR1urMFTvk8pXr+wIH2mk56+bhx9qcOE2D8quYe1hrbgSw66MIBF5xwY8PZo2OGzFcq1PCqESNsgYgGKIXs4bNSzB02zN7U/HtK9Yeq+c2K+Bcd0hvSA4wLNcfaKskgiw66cMAFJ9zY8JdnnANbREIto9RHSkS7VgeoTEo/yfPfZOi8Ir6oNEYk36zsAcbMsfarZJBFB1044IITbmy0O+BlwHcG6GaztV/sYS8pcdI5bLvHjLEr2q8WybYKf2t8UkYOjh/vgTFzrCGDLDrowgEXnHBjw9lry4DPAVrq2IS2JsNJRmmm9vEdpe6cImuMRfyjDK4W+RKlGDBmjrUGAVl00IUDLjjhxka8A74f9HVaq6t5GgtluFRGTqpkIMfID4p6ibrdDBkAjJljrV5AFh10ST9ccKbqNzb+FwfgytDvT/wOBM/A3dwCWnSmSnJNhwz4HLhbh5CuSC/IDh5CMnCiosKOHz9ux44etcrKSjty5IgdPnTYDh08aBVaKy8vtwP7D9j+sjLbt3ef7Q2HvZKLigBjgPFftFaVIaV6uzJcqDIs8pchGcB4a2trj/H9nj1WNHq0VctQVCRc44yLNZen9K5Wy/UakTpjl43IZYDIIW5sbLSfL1yxBbnFNvfFgg5oaGjw5Hbv2mWvi+iwUn9ZUV8SGL8R66AP6T0wW2nPFnrUikm7cwCcuXDZHn2lyOas2BQHHGhpabGSkhJ7ShcPWagSGdisMXOjZQyD/suIC43LKO92lxF7HnTgkZcL7MGcb+NQX1/vObBzx06bKcL3RUj/514g7cxx2t3HXcdc6VzH2zq5jnkKhDhwzoEz1Zds/kv59sDyDfFYtsHq6uqsubnZdmzf7kVIqp/QoQLzNHbl5owHHyQ8zVzq4x4knHbnQE5eiWUvW98Rz6+3aDTqObBNVRB8oPDp8CRTRnr0JKPUcODq9VqbtfSrGL70EC4/7YFxJBKxpqYmCxcXe8+v/qG2ByklhlH/o3Q5j1Jty20fpf4MUOc4UHPxqt3/3BftCJef8tJO5MX7q6y2ttZzoLhoi83S6R4Te5bzSsrs08d7hCxUxDzLt97Js5wm47bg8dyNNnPJZ7b4rcJ240SO8Zs3b3oOFBVutnW+Pyb09rVpaW1/TBQxdX72Tv6Y0OFwAPLKUzU245k1tvSDrd6p9zsBcLKwoOC/RtINiJjUd/nXjPbquhxlduz0H/b256XegcMpB1em3+XndzDUDl+6AVkI2uvwKS0t9dorHY4mQ51Tapx2Dhx7TtqJHOP569YZVziXWKdwa/r+XVsRtBf8/AvFvVQYv1p10QAAAABJRU5ErkJggg==50:T858,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGB0lEQVR4XsWXWWyUVRTHh7IVyiLQlZ2yFIiCUAV8EuVBfREMPikGoeKLxkYT1wiiiUl90EQwLhBUqC2lDEsKWCjUsqRAiMECgkqxxgSBCAE6072S4//3dW795mtpywNxkn/mzr3n/M9y7zn3TijUzad64kRrzcqyf6ZOtVvTptkt990FkEUH3SDfHX+uTpnSI6Me/HIaoxvk6/ZTEQpZZPJkq1cEjUJrT413AnSbxBGVI1F9n580qXuHMB6M+Jrmzk2YYBVjx9qWkSNtfXq6fZqaah/HwJg51pBBFh1PHy4gByJdOeAij4s4Nj6fmWlhka8cPtwWJSXZ7P79bVzv3pbSq5cHxsyxhgyy6Pg5+IYbG9gK2g9FnKcSblDKrgunFMn2UaPso5QUyxkyxBYMGGBZfftaSkKCJYqkdwyMmWMNGWTzkpMtLN0qccDVoAw4R3AiaD/EnrvIb0ihRun6JiPDnh40yGb06+cZGChDfYWETiJgjjVkkiV7r5xZJN0N2poaVQNOOH5sBfVDjS4DApF/LeMrhg616SK6R4RE6mRH6PecxER7TCkHczVmzq3jzFBtDRl5QRxwwen4seVkQxe0V5QLdes8JO2LBw+2aSIYJKJgxGTkXaV4o/YarNSYOb8MOknSJQC44HT82MKm1yds+vT2hWua5PCw5/eJMJ2DBhQdaU0TRur3k0rtJhGeUFQgX2PmWEuNyaKDboYAF5xwY6P9ULIVngOx1JyNnfYcpQ2CNJR1urMFTvk8pXr+wIH2mk56+bhx9qcOE2D8quYe1hrbgSw66MIBF5xwY8PZo2OGzFcq1PCqESNsgYgGKIXs4bNSzB02zN7U/HtK9Yeq+c2K+Bcd0hvSA4wLNcfaKskgiw66cMAFJ9zY8JdnnANbREIto9RHSkS7VgeoTEo/yfPfZOi8Ir6oNEYk36zsAcbMsfarZJBFB1044IITbmy0O+BlwHcG6GaztV/sYS8pcdI5bLvHjLEr2q8WybYKf2t8UkYOjh/vgTFzrCGDLDrowgEXnHBjw9lry4DPAVrq2IS2JsNJRmmm9vEdpe6cImuMRfyjDK4W+RKlGDBmjrUGAVl00IUDLjjhxka8A74f9HVaq6t5GgtluFRGTqpkIMfID4p6ibrdDBkAjJljrV5AFh10ST9ccKbqNzb+FwfgytDvT/wOBM/A3dwCWnSmSnJNhwz4HLhbh5CuSC/IDh5CMnCiosKOHz9ux44etcrKSjty5IgdPnTYDh08aBVaKy8vtwP7D9j+sjLbt3ef7Q2HvZKLigBjgPFftFaVIaV6uzJcqDIs8pchGcB4a2trj/H9nj1WNHq0VctQVCRc44yLNZen9K5Wy/UakTpjl43IZYDIIW5sbLSfL1yxBbnFNvfFgg5oaGjw5Hbv2mWvi+iwUn9ZUV8SGL8R66AP6T0wW2nPFnrUikm7cwCcuXDZHn2lyOas2BQHHGhpabGSkhJ7ShcPWagSGdisMXOjZQyD/suIC43LKO92lxF7HnTgkZcL7MGcb+NQX1/vObBzx06bKcL3RUj/514g7cxx2t3HXcdc6VzH2zq5jnkKhDhwzoEz1Zds/kv59sDyDfFYtsHq6uqsubnZdmzf7kVIqp/QoQLzNHbl5owHHyQ8zVzq4x4knHbnQE5eiWUvW98Rz6+3aDTqObBNVRB8oPDp8CRTRnr0JKPUcODq9VqbtfSrGL70EC4/7YFxJBKxpqYmCxcXe8+v/qG2ByklhlH/o3Q5j1Jty20fpf4MUOc4UHPxqt3/3BftCJef8tJO5MX7q6y2ttZzoLhoi83S6R4Te5bzSsrs08d7hCxUxDzLt97Js5wm47bg8dyNNnPJZ7b4rcJ240SO8Zs3b3oOFBVutnW+Pyb09rVpaW1/TBQxdX72Tv6Y0OFwAPLKUzU245k1tvSDrd6p9zsBcLKwoOC/RtINiJjUd/nXjPbquhxlduz0H/b256XegcMpB1em3+XndzDUDl+6AVkI2uvwKS0t9dorHY4mQ51Tapx2Dhx7TtqJHOP569YZVziXWKdwa/r+XVsRtBf8/AvFvVQYv1p10QAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791042887121,"unified_at":"2026-10-03T15:54:47.121Z","metadata":{"hashes":{"sha256":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","sha1":"c93518cff3e1554a9d9112b972bcfcdef77f6fed","md5":"b1ad5aa40c89bce3ed9d22762085fb2b","sha512":"6dc10010fbe21dd1f43d5465952b2ba39882c9c1cb3c9285d531fab937d18c2e1590a5987aad46d7f0a7fe41587f2b69a10095eb46f18acdd52533c48740605f","ssdeep":"98304:sfUbEBPzHDUZsrqpj4F4i0OY1ZjBpyTvodRYVBAywLtQzG:sfUoPzHDUZsrqpkFraUTvodRGAy4AG","ssdeep_chunks":["98304:sfUbEBP","98304:fUbEBPz","98304:UbEBPzH","98304:bEBPzHD","98304:EBPzHDU","98304:BPzHDUZ","98304:PzHDUZs","98304:zHDUZsr","98304:HDUZsrq","98304:DUZsrqp","98304:UZsrqpj","98304:Zsrqpj4","98304:srqpj4F","98304:rqpj4F4","98304:qpj4F4i","98304:pj4F4i0","98304:j4F4i0O","98304:4F4i0OY","98304:F4i0OY1","98304:4i0OY1Z","98304:i0OY1Zj","98304:0OY1ZjB","98304:OY1ZjBp","98304:Y1ZjBpy","98304:1ZjBpyT","98304:ZjBpyTv","98304:jBpyTvo","98304:BpyTvod","98304:pyTvodR","98304:yTvodRY","98304:TvodRYV","98304:vodRYVB","98304:odRYVBA","98304:dRYVBAy","98304:RYVBAyw","98304:YVBAywL","98304:VBAywLt","98304:BAywLtQ","98304:AywLtQz","98304:ywLtQzG","196608:sfUbEBP","196608:fUbEBPz","196608:UbEBPzH","196608:bEBPzHD","196608:EBPzHDU","196608:BPzHDUZ","196608:PzHDUZs","196608:zHDUZsr","196608:HDUZsrq","196608:DUZsrqp","196608:UZsrqpj","196608:Zsrqpj4","196608:srqpj4F","196608:rqpj4F4","196608:qpj4F4i","196608:pj4F4i0","196608:j4F4i0O","196608:4F4i0OY","196608:F4i0OY1","196608:4i0OY1Z","196608:i0OY1Zj","196608:0OY1ZjB","196608:OY1ZjBp","196608:Y1ZjBpy","196608:1ZjBpyT","196608:ZjBpyTv","196608:jBpyTvo","196608:BpyTvod","196608:pyTvodR","196608:yTvodRY","196608:TvodRYV","196608:vodRYVB","196608:odRYVBA","196608:dRYVBAy","196608:RYVBAyw","196608:YVBAywL","196608:VBAywLt","196608:BAywLtQ","196608:AywLtQz","196608:ywLtQzG","98304:sfUoPzH","98304:fUoPzHD","98304:UoPzHDU","98304:oPzHDUZ","98304:UZsrqpk","98304:ZsrqpkF","98304:srqpkFr","98304:rqpkFra","98304:qpkFraU","98304:pkFraUT","98304:kFraUTv","98304:FraUTvo","98304:raUTvod","98304:aUTvodR","98304:UTvodRG","98304:TvodRGA","98304:vodRGAy","98304:odRGAy4","98304:dRGAy4A","98304:RGAy4AG"],"imphash":"d7e2fd259780271687ffca462b9e69b7","pehash":"1fef78f9d223d747033b17007d317b53ec07fcc3"},"file_info":{"file_name":"b1ad5aa40c89bce3ed9d22762085fb2b.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4193605,"entropy":8,"compile_timestamp":"2017-11-18T22:00:38","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1711093196000,"last_seen":1787888402000,"last_multi_scan":1787888402000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":5,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":301367,"raw_size":301568},{"name":".rdata","virtual_address":"0x4b000","virtual_size":126304,"raw_size":126464},{"name":".data","virtual_address":"0x6a000","virtual_size":5936,"raw_size":2560},{"name":".wixburn","virtual_address":"0x6c000","virtual_size":56,"raw_size":512},{"name":".rsrc","virtual_address":"0x6d000","virtual_size":14864,"raw_size":15360},{"name":".reloc","virtual_address":"0x71000","virtual_size":15868,"raw_size":15872}],"section_names":[".text",".rdata",".data",".wixburn",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","informationstealer","hijackloaderpayload","rhadamanthys","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":3,"threat_actors_count":2,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":93},"sandbox_signatures":{"informative_count":302,"suspicious_count":19,"malicious_count":9,"total":330},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.35376238","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.35376238 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.bxov!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VKN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Rhadamanthys","sources":[{"report_type":"qsp","report_id":""}]},{"value":"HijackLoaderPayload","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"BANISHED KITTEN","sources":[{"report_type":"qsp","report_id":""}]},{"value":"BRAIN SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Calls APIs used for Remove Service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"},{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"suspicious","value":"Able to change service configuration"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to retrieve event logs (API string)"},{"type":"informative","value":"Contains ability to retrieve event logs (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Imports windows networking-related APIs"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Software\\Classes\\Installer\\Dependencies\\\" in Source: sample.bin, \"SOFTWARE\\Policies\\\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" in Source: sample.bin, \"SOFTWARE\\%ls\\Updates\\\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\" in Source: sample.bin, \"SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"Failed to CreateProcess on path: %ls\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\%ls, Found string - \\\\.\\pipe\\%ls.Cache","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\agent\\_work\\8\\s\\build\\ship\\x86\\burn.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-225","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\runonce\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"\".wuauserv\" (Indicator: \"wuauserv\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-10073","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$27","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegQueryInfoKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\"), Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-539","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; Source: \"sample.bin\"), Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\"), Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Failed to connect to unelevated process.\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Failed to get shutdown privilege LUID.\" (Indicator: \" shutdown \"; Source: \"sample.bin\"), Found reference to API \"Failed to wait for embedded process to connect to pipe.\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Failed to adjust token to add shutdown privileges.\" (Indicator: \" shutdown \"; Source: \"sample.bin\"), Found reference to API \"Failed to connect to parent of embedded process.\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Failed to connect to elevated child process.\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Failed to wait for child to connect to pipe.\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Failed to post shutdown message.\" (Indicator: \" shutdown \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://appsyndication.org/2006/appsyn\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-241","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-538","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.2.1.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-453","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptHashPublicKeyInfo\" (Indicator: \"CryptHashPublicKeyInfo\"; Source: \"sample.bin\"), Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found api reference \"DecryptFileW\" (Indicator: \"DecryptFileW\"; Source: \"sample.bin\"), Found api reference \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"sample.bin\"), Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found api reference \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\"), Found api reference \"CertGetCertificateContextProperty\" (Indicator: \"CertGetCertificateContextProperty\"; Source: \"sample.bin\"), Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\"), Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFileW\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-920","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Failed to get certificate public key identifier.\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"Failed to find expected public key in certificate chain.\" (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-108","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.001","id":"string-237","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1006","id":"string-194","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"Failed to find DllGetVersion entry point in msi.dll.\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (Source: \"sample.bin\"), Found string \"QueryServiceStatus\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\"), Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-906","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00005648)\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00005712)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"RemoveDirectoryW\" with parameter %WINDIR%\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\ (UID: 00000000-00005648)\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"RemoveDirectoryW\" with parameter %WINDIR%\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\ (UID: 00000000-00005648)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005792.00000000.78110.02BE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005792.00000001.78360.02D00000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"RttHlp.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 6E6B0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"RttHlp.exe\" queried SystemProcessInformation at 00000000-00005792-00000105-1367043 [PID: 5792]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 11999-1626-0042E3D8\n SetUnhandledExceptionFilter@KERNEL32.dll at 11999-2340-0042E9DC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005648-14599-5-00CAE88A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005648-14599-26-00CB3C76\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005648-14599-1275-00CAE3D8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005712-16348-5-00C3E88A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005712-16348-26-00C43C76\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005712-16348-1275-00C3E3D8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005648.00000001.78384.00370000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.96519","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResourceA\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp, 00000000-00005792.00000001.78360.00287000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp, 00000000-00005792.00000001.78360.00287000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"setupdigetclassdevs\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"RttHlp.exe\" called \"RtlDecompressBuffer\" with parameters (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005648)\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005712)\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005712)\n \"RttHlp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005792)\n \"RttHlp.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005792)\n \"RttHlp.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005792)\n \"RttHlp.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005648)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"RttHlp.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"IsWow64Process\" with parameter \"5712\" - (UID: 00000000-00005712)\n \"RttHlp.exe\" called \"IsWow64Process\" with parameter \"5792\" - (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"RttHlp.exe\" called \"EnumWindows\" with parameter \"1234532\" - (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"RttHlp.exe\" called \"GetActiveWindow\" (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005712)\n \"RttHlp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005712)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005712)\n \"RttHlp.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005792)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 11999-1522-00419B43\n FindFirstFileExW@KERNEL32.DLL at 00000000-00005648-14599-104-00CB7C25\n FindFirstFileW@KERNEL32.DLL at 00000000-00005648-14599-587-00CC4440\n FindFirstFileW@KERNEL32.DLL at 00000000-00005648-14599-784-00C83CC4\n FindFirstFileW@KERNEL32.DLL at 00000000-00005648-14599-1171-00C99B43\n FindFirstFileExW@KERNEL32.DLL at 00000000-00005712-16348-104-00C47C25\n FindFirstFileW@KERNEL32.DLL at 00000000-00005712-16348-587-00C54440\n FindFirstFileW@KERNEL32.DLL at 00000000-00005712-16348-784-00C13CC4\n FindFirstFileW@KERNEL32.DLL at 00000000-00005712-16348-1171-00C29B43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005648-14599-582-00CC5D03\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005648-14599-1302-00CAE776\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005712-16348-582-00C55D03\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005712-16348-1302-00C3E776","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 11999-1457-00406037\n GetLocalTime@KERNEL32.DLL at 00000000-00005648-14599-211-00CBFEC6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005648-14599-582-00CC5D03\n GetLocalTime@KERNEL32.DLL at 00000000-00005648-14599-588-00C82DBF\n GetSystemTime@KERNEL32.DLL at 00000000-00005648-14599-974-00CC86D7\n GetSystemTime@KERNEL32.DLL at 00000000-00005648-14599-1106-00C86037\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005648-14599-1302-00CAE776\n GetLocalTime@KERNEL32.DLL at 00000000-00005712-16348-211-00C4FEC6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005712-16348-582-00C55D03\n GetLocalTime@KERNEL32.DLL at 00000000-00005712-16348-588-00C12DBF\n GetSystemTime@KERNEL32.DLL at 00000000-00005712-16348-974-00C586D7\n GetSystemTime@KERNEL32.DLL at 00000000-00005712-16348-1106-00C16037\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005712-16348-1302-00C3E776","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005648-14599-975-00CC887B\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00005712-16348-975-00C5887B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 11999-1462-004062AA\n GetVersionExW@KERNEL32.DLL at 00000000-00005648-14599-202-00C85195\n GetVersionExW@KERNEL32.DLL at 00000000-00005648-14599-719-00CC3AF1\n GetVersionExW@KERNEL32.DLL at 00000000-00005648-14599-1111-00C862AA\n GetVersionExW@KERNEL32.DLL at 00000000-00005712-16348-202-00C15195\n GetVersionExW@KERNEL32.DLL at 00000000-00005712-16348-719-00C53AF1\n GetVersionExW@KERNEL32.DLL at 00000000-00005712-16348-1111-00C162AA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"RttHlp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetNativeSystemInfo@KERNEL32.dll at 11999-1471-00406745\n GetSystemInfo@KERNEL32.dll at 11999-1716-004497A7\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00005648-14599-1120-00C86745\n GetSystemInfo@KERNEL32.DLL at 00000000-00005648-14599-1437-00CC97A7\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00005712-16348-1120-00C16745\n GetSystemInfo@KERNEL32.DLL at 00000000-00005712-16348-1437-00C597A7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@KERNEL32.dll at 11999-1450-00405E30\n GetUserDefaultUILanguage@KERNEL32.dll at 11999-1451-00405E62\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00005648-14599-1099-00C85E30\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005648-14599-1100-00C85E62\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00005712-16348-1099-00C15E30\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005712-16348-1100-00C15E62","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp eax, E0000000h\" and \"je 00CBFF61h\" at 00000000-00005648-14599-211-00CBFEC6\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp ax, word ptr [ecx]\" and \"je 00C82F27h\" at 00000000-00005648-14599-588-00C82DBF\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000011Ch], 04h\" and \"jne 00CC3B65h\" at 00000000-00005648-14599-719-00CC3AF1\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp eax, E0000000h\" and \"je 00C4FF61h\" at 00000000-00005712-16348-211-00C4FEC6\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp ax, word ptr [ecx]\" and \"je 00C12F27h\" at 00000000-00005712-16348-588-00C12DBF\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000011Ch], 04h\" and \"jne 00C53B65h\" at 00000000-00005712-16348-719-00C53AF1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"RttHlp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"RttHlp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{27B8CD1B-5862-4286-BE33-02EF90C398D9}\")\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{27B8CD1B-5862-4286-BE33-02EF90C398D9}.REBOOTREQUIRED\")\n \"RttHlp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\DRIVER BOOSTER_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 212198)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A853277.bin\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005648.00000000.77738.00CCB000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005712.00000000.77908.00C5B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\"\" - (UID: 00000000-00005648)\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\RttHlp.exe\" - (UID: 00000000-00005712)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00005648-14599-775-00C94EDF\n CreateNamedPipeW@KERNEL32.DLL at 00000000-00005712-16348-775-00C24EDF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$32","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 11999-1725-0044998E\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005648-14599-53-00CB88B2\n LoadLibraryW@KERNEL32.DLL at 00000000-00005648-14599-184-00C83838\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005648-14599-945-00C8D6C9\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005648-14599-1285-00CB16A6\n LoadLibraryExA@KERNEL32.DLL at 00000000-00005648-14599-1446-00CC998E\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005712-16348-53-00C488B2\n LoadLibraryW@KERNEL32.DLL at 00000000-00005712-16348-184-00C13838\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005712-16348-945-00C1D6C9\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005712-16348-1285-00C416A6\n LoadLibraryExA@KERNEL32.DLL at 00000000-00005712-16348-1446-00C5998E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$33","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf)\n Found MoveFileW in import section (Source: Patrial.dll)\n Found MoveFileW in import section (Source: Register.dll)\n Found MoveFileExW in import section (Source: 276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin)\n Found MoveFileW in import section (Source: rtl120.bpl)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"vcl120.bpl\" as clean (type is \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections\"), Antivirus vendors marked dropped file \"rtl120.bpl\" as clean (type is \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 9 sections\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6A853277.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-1\" - [base:0; Status:c0000135]\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" failed to load missing module \"ext-ms-win-kernel32-package-current-l1-1-0\" - [base:0; Status:c0000135]\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"RttHlp.exe\" failed to load missing module \"Register.dll\" - [base:0; Status:c0000142]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Patrial.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DISMHOST.EXE.6A853277.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"https://www.facebook.com/iobitsoft\" (Indicator: \"facebook.com\"; File: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")\n Found string \"https://twitter.com/iobitsoft\" (Indicator: \"twitter\"; File: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")\n Found string \"www.facebook.com/iobitsoft\" (Indicator: \"facebook.com\"; File: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 755B0000\n \"RttHlp.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 755B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020738665@ADVAPI32.dll\"\n \"0e000f00e4738665@ADVAPI32.dll\"\n \"0e000f0050748665@ADVAPI32.dll\"\n \"11001200d47d8665@ADVAPI32.dll\"\n \"110012007c7e8665@ADVAPI32.dll\"\n \"12001300cc7e8665@ADVAPI32.dll\"\n \"12001300387f8665@ADVAPI32.dll\"\n \"14001500e4b78665@ADVAPI32.dll\"\n \"1400150000b88665@ADVAPI32.dll\"\n \"140015001cb88665@ADVAPI32.dll\"\n \"1700180038b88665@ADVAPI32.dll\"\n \"0d000e0054b88665@ADVAPI32.dll\"\n \"1100120064b88665@ADVAPI32.dll\"\n \"110012007cb88665@ADVAPI32.dll\"\n \"0d000e009c7f8665@SHELL32.dll\"\n \"0d000e0028808665@SHELL32.dll\"\n \"0f001000ecb98665@ADVAPI32.dll\"\n \"1400150038ba8665@ADVAPI32.dll\"\n \"1400150054ba8665@ADVAPI32.dll\"\n \"0c000d00a8ba8665@ADVAPI32.dll\"\n \"0c000d00b8ba8665@ADVAPI32.dll\"\n \"0e000f00c8ba8665@ADVAPI32.dll\"\n \"0e000f00dcba8665@ADVAPI32.dll\"\n \"0b000c00f0ba8665@ADVAPI32.dll\"\n \"0d000e0094bb8665@bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$36","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" touched \"XML DOM Document\" (Path: \"HKCU\\CLSID\\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"Patrial.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DISMHOST.EXE.6A853277.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\" has an executable section named \".text\"\n \"Patrial.dll\" has an executable section named \".text\"\n \"Register.dll\" has an executable section named \".text\"\n \"Register.dll\" has an executable section named \".itext\"\n \"RttHlp.exe\" has an executable section named \".text\"\n \"RttHlp.exe\" has an executable section named \".itext\"\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" has an executable section named \".text\"\n \"vcl120.bpl\" has an executable section named \".text\"\n \"vcl120.bpl\" has an executable section named \".itext\"\n \"rtl120.bpl\" has an executable section named \".text\"\n \"rtl120.bpl\" has an executable section named \".itext\"\n \"DISMHOST.EXE.6A853277.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"rtl120.bpl\" : \"270\" [Source: RttHlp.exe]\n Observed large number of imported APIs from \"rtl120.bpl\" : \"832\" [Source: vcl120.bpl]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\" has an writable section named \".data\"\n \"Patrial.dll\" has an writable section named \".data\"\n \"Register.dll\" has an writable section named \".data\"\n \"Register.dll\" has an writable section named \".bss\"\n \"Register.dll\" has an writable section named \".idata\"\n \"RttHlp.exe\" has an writable section named \".data\"\n \"RttHlp.exe\" has an writable section named \".bss\"\n \"RttHlp.exe\" has an writable section named \".idata\"\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" has an writable section named \".data\"\n \"vcl120.bpl\" has an writable section named \".data\"\n \"vcl120.bpl\" has an writable section named \".bss\"\n \"vcl120.bpl\" has an writable section named \".idata\"\n \"rtl120.bpl\" has an writable section named \".data\"\n \"rtl120.bpl\" has an writable section named \".bss\"\n \"rtl120.bpl\" has an writable section named \".idata\"\n \"DISMHOST.EXE.6A853277.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x144800\" greater than 0x100000\n Raw size of \".text\" is \"0x11fc00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x144682\" greater than 0x100000\n Virtual size of \".text\" is \"0x11fb18\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" [Source: 00000000-00005648-00000C47-5739494312]\n Observed system executable string:\"\"%WINDIR%\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\"\" [Source: 00000000-00005648-00000C47-5739494312]\n Observed system executable string:\"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\RttHlp.exe\" [Source: 00000000-00005712-00000C47-7131973660]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (UID: 00000000-00005712) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (UID: 00000000-00005712) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"RttHlp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"RttHlp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"RttHlp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\msxml3r.dll\" [Source: 00000000-00005648-00000C2B-219021173]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00005712-00000C2B-221590273]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00005712-00000C2B-221957199]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00005712-00000C2B-222145953]\n Observed system executable string:\"%WINDIR%\\system32\\crtdll.dll\" [Source: 00000000-00005792-00000C2B-224693644]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" with commandline \"-burn.clean.room=\"C:\\\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd27 ...\" (UID: 00000000-00005712), Spawned process \"RttHlp.exe\" (UID: 00000000-00005792)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" with commandline \"-burn.clean.room=\"C:\\\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd27 ...\" (UID: 00000000-00005712), Spawned process \"RttHlp.exe\" (UID: 00000000-00005792)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Patrial.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Register.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"RttHlp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"vcl120.bpl\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"rtl120.bpl\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6A853277.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" writes to a file \"C:\\Windows\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" connecting to \"\\ThemeApiPort\"\n \"RttHlp.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"$snapinRes = Add-PSSnapin WDeploySnapin3.0 -PassThru -ErrorVariable +errVar\" (Indicator: \"Add-PSSnapIn\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 11999-1460-004061DF\n GetUserNameW@ADVAPI32.DLL at 00000000-00005648-14599-1109-00C861DF\n GetUserNameW@ADVAPI32.DLL at 00000000-00005712-16348-1109-00C161DF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$39","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"BootstrapperApplicationData.xml\" has type \"XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (471) with CRLF line terminators\" - Location: [%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\BootstrapperApplicationData.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Patrial.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\Patrial.dll]- [targetUID: 00000000-00005712]\n \"Register.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 8 sections\"- Location: [%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\Register.dll]- [targetUID: 00000000-00005712]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" reads file \"c:\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$3c","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" writes file \"c:\\windows\\temp\\{5d1b60d1-6b70-4699-b884-44c740c22e09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" writes a file \"C:\\Windows\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\squirearch.db\"\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Breakdown_20260819034716.log\"\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" writes a file \"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\squirearch.db\"\n \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" writes a file \"%TEMP%\\Breakdown_20260819034716.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"end a network resource enumeration\" [Source: rtl120.bpl]\n Observed import api \"WNetEnumResource\" which can \"continue an enumeration of network recls.sources\" [Source: rtl120.bpl]\n Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: rtl120.bpl]\n Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: rtl120.bpl]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.facebook.com\"\n Found HTTPS url \"https://twitter.com\"\n Found HTTPS url \"https://www.iobit.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"Register.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"bugcloud\" (Indicator: \"gcloud\"; Source: \"00000000-00005792.00000000.78110.01940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp, 00000000-00005792.00000001.78360.00287000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Patrial.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"RttHlp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"RttHlp.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"cDCPrijndael\" (Indicator: \"rijndael\"; Source: \"00000000-00005792.00000000.78110.0041E000.00000002.mdmp\")\n Found string \"DCPbase64\" (Indicator: \"base64\"; Source: \"00000000-00005792.00000000.78110.0041E000.00000002.mdmp\")\n Found string \"YAESUtils\" (Indicator: \"aes\"; Source: \"00000000-00005792.00000000.78110.0041E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf)\n Found GetCursorPos() in an import section (Source: Register.dll)\n Found GetCursorPos() in an import section (Source: 276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin)\n Found GetCursorPos() in an import section (Source: vcl120.bpl)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"Get-Content $aParamFilePath -ErrorVariable +errVar | `\" (Indicator: \"Get-Content\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")\n Found string \"Get-Content $aDestSettingsFilePath -ErrorVariable +errVar | `\" (Indicator: \"Get-Content\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"@Multimon@GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp, 00000000-00005792.00000001.78360.00287000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: vcl120.bpl]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf]\n Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: 276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005648.00000001.78384.00370000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00005792.00000000.78110.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$43","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" opened \"\\Device\\KsecDD\"\n \"RttHlp.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DEBUGHEAPFLAGS\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"$logVar | Out-File $aPublLogPath -Width 1000\" (Indicator: \"Out-File\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")\n Found string \"$errVar | Out-File $aErrDumpPath -Width 1000\" (Indicator: \"Out-File\"; Source: \"00000000-00005712.00000000.77908.002E0000.00000004.mdmp, 00000000-00005712.00000001.78366.002E0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp, 00000000-00005792.00000001.78360.00287000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"hypha.rpm has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Patrial.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"Register.dll\" was detected as \"Borland Delphi 4.0\"\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"vcl120.bpl\" was detected as \"Morphine v1.2 (DLL)\"\n \"rtl120.bpl\" was detected as \"Morphine v1.2 (DLL)\"\n \"DISMHOST.EXE.6A853277.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"RttHlp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"RttHlp.exe queries ProcessDebugPort (UID: 5792)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/24 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"suspicious","category":"General","name":"Able to change service configuration","description":"ChangeServiceConfigW@ADVAPI32.dll at 11999-1539-00426B88\n ChangeServiceConfigW@ADVAPI32.DLL at 00000000-00005648-14599-1188-00CA6B88\n ChangeServiceConfigW@ADVAPI32.DLL at 00000000-00005712-16348-1188-00C36B88","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543.003","relevance":5,"id":"stream-73","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@KERNEL32.DLL at 00000000-00005648-14599-344-00C84115\n CreateDirectoryW@KERNEL32.DLL at 00000000-00005712-16348-344-00C14115","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$45","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$46","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005792.00000000.78110.00210000.00000004.mdmp, 00000000-00005792.00000001.78360.00287000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" marked \"C:\\Windows\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" opened \"C:\\Windows\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Patrial.dll\" claimed CRC 1834305 while the actual is CRC 1814911\n \"Register.dll\" claimed CRC 1088419 while the actual is CRC 1127310\n \"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin\" claimed CRC 164662 while the actual is CRC 3988086\n \"rtl120.bpl\" claimed CRC 2077376 while the actual is CRC 1164373\n \"DISMHOST.EXE.6A853277.bin\" claimed CRC 1164373 while the actual is CRC 103114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$47","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Reads Antivirus engine related registry keys","description":"\"RttHlp.exe\" (Path: \"HKLM\\SOFTWARE\\IOBIT\\DRIVER BOOSTER\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"$48","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004052.00000000.67284.025A0000.00000004.mdmp, 00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004052.00000000.67284.025A0000.00000004.mdmp, 00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\%ls; Source: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found string - \\\\.\\pipe\\%ls.Cache; Source: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found string - \\\\.\\PhysicalDrive%d; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")\n Found string - \\\\.\\PHYSICALDRIVE0; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"PlaiDecodeBase64Char\" (Indicator: \"decodebase64\"; Source: \"00000000-00004052.00000000.67284.025A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"RttHlp.exe.372969176\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp, 00000000-00004052.00000000.67284.50001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"RttHlp.exe.372969176\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"RttHlp.exe.372969176\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"RttHlp.exe.372969176\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00004052.00000000.67284.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00004052.00000000.67284.00401000.00000020.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00004052.00000000.67284.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 26766-109-00407814\n \"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 00000000-00004052.00000000.67284.04E21000.00000020.mdmp\n 00000000-00004052.00000000.67284.50001000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"explorer.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$4a","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"RttHlp.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004052)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 212198)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:4140:168:WilStaging_02\"\n \"Local\\SM0:4988:168:WilStaging_02\"\n \"SM0:4988:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.1; rv:28.0) Firefox/28.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\AdvApi32.dll\" [Source: 00000000-00007760-00000C25-39547504]\n Observed system executable string:\"%WINDIR%\\system32\\Msi.dll\" [Source: 00000000-00007760-00000C25-39630510]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\crtdll.dll\" [Source: 00000000-00006584-00000C25-42783476]\n Observed system executable string:\"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\Register.dll\" [Source: 00000000-00006584-00000C37-2344759594]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" queries basic process information of the \"C:\\b1ad5aa40c89bce3ed9d22762085fb2b.exe\" (UID: 7760)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"cmd.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CLIENTNODE1.LNK\"\n \"cmd.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\CLIENTNODE1.LNK\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imx.l\" [Source: 00000000-00004052.00000000.67284.05383000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0 200 OK\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"ends a network resource enumeration\" [Source: rtl120.bpl]\n Observed import api \"WNetEnumResource\" which can \"continues an enumeration of network resources\" [Source: rtl120.bpl]\n Observed import api \"WNetGetUniversalName\" which can \"takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: rtl120.bpl]\n Observed import api \"WNetOpenEnum\" which can \"starts an enumeration of network resources or existing connections.\" [Source: rtl120.bpl]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"Register.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"33622504\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"RttHlp.exe\" called \"GetComputerNameW\" (UID: 00000000-00006584)\n \"RttHlp.exe\" called \"GetComputerNameW\" (UID: 00000000-00004052)\n \"cmd.exe\" called \"GetComputerNameW\" (UID: 00000000-00004988)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Temp\\{09A47700-80E3-48B9-AB6C-8A9EA332363D}\\*.* (UID: 00000000-00007760)\n \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00007760)\n \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" called \"FindNextFileW\" with parameter .cr (UID: 00000000-00007760)\n \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Temp\\{09A47700-80E3-48B9-AB6C-8A9EA332363D}\\.cr\\*.* (UID: 00000000-00007760)\n \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" called \"FindNextFileW\" with parameter b1ad5aa40c89bce3ed9d22762085fb2b.exe (UID: 00000000-00007760)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"RtlGetVersion\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: b1ad5aa40c89bce3ed9d22762085fb2b.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Patrial.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004052.00000000.67284.04E21000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"RttHlp.exe\" - Location: [%APPDATA%\\TyfConfig_alpha\\RttHlp.exe]- [targetUID: 00000000-00004140]\n Dropped file: \"Register.dll\" - Location: [%APPDATA%\\TyfConfig_alpha\\Register.dll]- [targetUID: 00000000-00004140]\n Dropped file: \"vcl120.bpl\" - Location: [%APPDATA%\\TyfConfig_alpha\\vcl120.bpl]- [targetUID: 00000000-00004140]\n Dropped file: \"rtl120.bpl\" - Location: [%APPDATA%\\TyfConfig_alpha\\rtl120.bpl]- [targetUID: 00000000-00004140]\n Dropped file: \"hypha.rpm\" - Location: [%APPDATA%\\TyfConfig_alpha\\hypha.rpm]- [targetUID: 00000000-00004140]\n Dropped file: \"squirearch.db\" - Location: [%APPDATA%\\TyfConfig_alpha\\squirearch.db]- [targetUID: 00000000-00004140]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@kernel32.dll at 23598-406-004014C8\n GetModuleHandleW@kernel32.dll at 23598-404-00406AC8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"cmd.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"cmd.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Network Related","name":"Spawned processes likely due to injection","description":"Process \"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\RttHlp.exe\" spawned likely due to injection\n Process \"%APPDATA%\\TyfConfig_alpha\\RttHlp.exe\" spawned likely due to injection\n Process \"%WINDIR%\\SysWOW64\\cmd.exe\" spawned likely due to injection\n Process \"%WINDIR%\\SysWOW64\\explorer.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on process \"00000000-00004052\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-112","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"cmd.exe /k ipconfig /flushdns &Exit\" (Indicator: \"ipconfig\"; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")\n Found string \"cmd.exe /k ping\" (Indicator: \"ping\"; Source: \"00000000-00004052.00000000.67284.04E21000.00000020.mdmp\")\n Found string \"No route to host.\" (Indicator: \"route\"; Source: \"00000000-00004052.00000000.67284.04F0F000.00000002.mdmp\")\n Found string \"Resolving hostname %s.\" (Indicator: \"hostname\"; Source: \"00000000-00004052.00000000.67284.04F0F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\SysWOW64\\explorer.exe\" - (UID: 00000000-00004988)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Temp\\{09A47700-80E3-48B9-AB6C-8A9EA332363D}\\.cr\\b1ad5aa40c89bce3ed9d22762085fb2b.exe\" (Handle: 616)\n \"b1ad5aa40c89bce3ed9d22762085fb2b.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\RttHlp.exe\" (Handle: 900)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\".wuauserv\" (Indicator: \"wuauserv\") in Source: b1ad5aa40c89bce3ed9d22762085fb2b.exe","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"References security-related Windows services"},{"detail":"Able to change service configuration"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to enumerate volumes"}],"sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}],"intel_graph":{"map":{"Adversary:0d2ba31712ecc1f72bfc00e8e6d37fcfc558f14db3e60171220fb122e9b8bcbf":{"type":"Adversary","value":"BANISHED KITTEN","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Adversary:b2cec45d88be8b578e0741dbce15e613dbc7e465833e88f331683b3a484e6158":{"type":"Adversary","value":"BRAIN SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"File:0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03":{"type":"File","value":"0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Rhadamanthys","confirmed relationship with a Threat","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac":{"type":"File","value":"1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac"},"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf":{"type":"File","value":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat HijackLoaderPayload","Detected relationship with a Threat Rhadamanthys","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat Rhadamanthys","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:3066645428dd243b56d828d7868da52824eb56758a4a0cfc269f500c57695edc":{"type":"File","value":"3066645428dd243b56d828d7868da52824eb56758a4a0cfc269f500c57695edc"},"File:3cfa549fa6ab5f8d8b415a7384b7530ea9842482d0a7a16476dfe5a24c9fff9e":{"type":"File","value":"3cfa549fa6ab5f8d8b415a7384b7530ea9842482d0a7a16476dfe5a24c9fff9e"},"File:479d3dfecf0ac91b81978e17978229b94818c9d258896b3b7ecc3cab121ae183":{"type":"File","value":"479d3dfecf0ac91b81978e17978229b94818c9d258896b3b7ecc3cab121ae183"},"File:483bc8bb54ba240ae356b16a67a1892ebc4bc764db6422c7e862ff90607e1e77":{"type":"File","value":"483bc8bb54ba240ae356b16a67a1892ebc4bc764db6422c7e862ff90607e1e77"},"File:572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec":{"type":"File","value":"572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec"},"File:5c1a3808abb0bd02bc2d1dc11d70abc55ce22a256bcd497c126345be3003821b":{"type":"File","value":"5c1a3808abb0bd02bc2d1dc11d70abc55ce22a256bcd497c126345be3003821b"},"File:87550210bd083496cd991c90dbc6bdb89ee8bf5873f8d8fad8e255c6fc4a5f54":{"type":"File","value":"87550210bd083496cd991c90dbc6bdb89ee8bf5873f8d8fad8e255c6fc4a5f54"},"File:8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473":{"type":"File","value":"8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473"},"File:9fd04e72a7dcf7381a5953f631ab6e71156250a86aa9e6958e5261d55e3bf2fc":{"type":"File","value":"9fd04e72a7dcf7381a5953f631ab6e71156250a86aa9e6958e5261d55e3bf2fc"},"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e":{"type":"File","value":"acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat HijackLoaderPayload","Detected relationship with a Threat Rhadamanthys","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat Rhadamanthys","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]},"filetype":"data (from detonation dropped)","filetype_short":"DATA","mime_type":"image/png"},"File:c69149e6e6e271f7655381ccd513f91eba0f57a2b20b8c4bfbc01a0ca769fc20":{"type":"File","value":"c69149e6e6e271f7655381ccd513f91eba0f57a2b20b8c4bfbc01a0ca769fc20"},"File:d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50":{"type":"File","value":"d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Threat:9e788c57e7d23abc1808c3490810b6112ba07d25977357f468f46ee03f9a3526":{"type":"Threat","value":"HijackLoaderPayload","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat HijackLoaderPayload"]}},"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d":{"type":"Threat","value":"Rhadamanthys","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Rhadamanthys","confirmed relationship with a Threat","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]}},"Url:377095e8ab03c8dab1fc7c8c5b8463c51b1d7cadad627eaa16777ffed7f2b459":{"type":"Url","value":"https://94.156.8.83:4785/531f751d32a6cfcb/fdl16fq7.j6l1q","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1542740536282328050","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat HijackLoaderPayload","Detected relationship with a Threat Rhadamanthys","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat Rhadamanthys","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]}},{"id":"1542740527224746278","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"Threat:9e788c57e7d23abc1808c3490810b6112ba07d25977357f468f46ee03f9a3526"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542740560844148075","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]}},{"id":"1542740541210662046","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[{"edge_kind":"dropped","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e"},{"edge_kind":"is_threat","from_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","to_key":"Threat:9e788c57e7d23abc1808c3490810b6112ba07d25977357f468f46ee03f9a3526"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542740534564579495","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[{"edge_kind":"dropped","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e"},{"edge_kind":"extracted","from_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","to_key":"File:0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03"},{"edge_kind":"is_threat","from_key":"File:0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03","to_key":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542740534564579496","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[{"edge_kind":"dropped","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e"},{"edge_kind":"extracted","from_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","to_key":"File:0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03"},{"edge_kind":"contains_c2_config","from_key":"File:0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03","to_key":"Url:377095e8ab03c8dab1fc7c8c5b8463c51b1d7cadad627eaa16777ffed7f2b459"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1542740539824273305","root":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat HijackLoaderPayload","Detected relationship with a Threat Rhadamanthys","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat HijackLoaderPayload","confirmed relationship with a Threat Rhadamanthys","confirmed relationship with an Adversary BANISHED KITTEN","confirmed relationship with an Adversary BRAIN SPIDER"]}},{"id":"1542740539824273304","root":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","to_key":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542740539975268253","root":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d","edges":[{"edge_kind":"used_by","from_key":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d","to_key":"Adversary:0d2ba31712ecc1f72bfc00e8e6d37fcfc558f14db3e60171220fb122e9b8bcbf"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1542740539979462558","root":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d","edges":[{"edge_kind":"used_by","from_key":"Threat:ccda743bcc85409262ed46335dccc679309a85dd1e201da9ca1ce175db69123d","to_key":"Adversary:b2cec45d88be8b578e0741dbce15e613dbc7e465833e88f331683b3a484e6158"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","edges":[{"edge_kind":"dropped","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:5c1a3808abb0bd02bc2d1dc11d70abc55ce22a256bcd497c126345be3003821b"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:87550210bd083496cd991c90dbc6bdb89ee8bf5873f8d8fad8e255c6fc4a5f54"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:483bc8bb54ba240ae356b16a67a1892ebc4bc764db6422c7e862ff90607e1e77"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:479d3dfecf0ac91b81978e17978229b94818c9d258896b3b7ecc3cab121ae183"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:3066645428dd243b56d828d7868da52824eb56758a4a0cfc269f500c57695edc"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:c69149e6e6e271f7655381ccd513f91eba0f57a2b20b8c4bfbc01a0ca769fc20"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:3cfa549fa6ab5f8d8b415a7384b7530ea9842482d0a7a16476dfe5a24c9fff9e"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:9fd04e72a7dcf7381a5953f631ab6e71156250a86aa9e6958e5261d55e3bf2fc"},{"edge_kind":"extracted","from_key":"File:276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","to_key":"File:9fd04e72a7dcf7381a5953f631ab6e71156250a86aa9e6958e5261d55e3bf2fc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":127,"dropped_files_count":1,"extracted_files_count":19,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":1,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["criminal","informationstealer","hijackloaderpayload","rhadamanthys","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6a850b0c885df8255103942c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","analysis_start_time":"2026-08-19T01:46:54+00:00","indicators_count":{"informative":255,"suspicious":57,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"65fd35cbe93b12f4120726e0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"b1ad5aa40c89bce3ed9d22762085fb2b.exe","analysis_start_time":"2024-03-22T07:39:56+00:00","indicators_count":{"informative":191,"suspicious":33,"malicious":6},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null,"embedded_urls":[{"value":"https://94.156.8.83:4785/531f751d32a6cfcb/fdl16fq7.j6l1q","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}],"processes":[{"pid":7760,"ppid":0,"name":"b1ad5aa40c89bce3ed9d22762085fb2b.exe","command_line":"","sha256":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf","normalized_path":"C:\\b1ad5aa40c89bce3ed9d22762085fb2b.exe","uid":"00000000-00007760","icon":"$4d"},{"pid":4140,"ppid":7760,"name":"b1ad5aa40c89bce3ed9d22762085fb2b.exe","command_line":"-burn.clean.room=\"C:\\b1ad5aa40c89bce3ed9d22762085fb2b.exe\" -burn.filehandle.attached=612 -burn.filehandle.self=632","sha256":"1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac","normalized_path":"%WINDIR%\\Temp\\{09A47700-80E3-48B9-AB6C-8A9EA332363D}\\.cr\\b1ad5aa40c89bce3ed9d22762085fb2b.exe","parent_uid":"00000000-00007760","uid":"00000000-00004140"},{"pid":6584,"ppid":4140,"name":"RttHlp.exe","command_line":"","sha256":"8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473","normalized_path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\RttHlp.exe","parent_uid":"00000000-00004140","uid":"00000000-00006584"},{"pid":4052,"ppid":6584,"name":"RttHlp.exe","command_line":"","sha256":"8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473","normalized_path":"%APPDATA%\\TyfConfig_alpha\\RttHlp.exe","parent_uid":"00000000-00006584","uid":"00000000-00004052"},{"pid":4988,"ppid":4052,"name":"cmd.exe","command_line":"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004052","uid":"00000000-00004988"},{"pid":7268,"ppid":4988,"name":"explorer.exe","command_line":"","sha256":"b2b8b4b9a37644531d9d887473f01da2ffedc86938f93349e758ff3598027561","normalized_path":"%WINDIR%\\SysWOW64\\explorer.exe","parent_uid":"00000000-00004988","uid":"00000000-00007268"},{"pid":6312,"ppid":7268,"name":"WerFault.exe","command_line":"-u -p 7268 -s 744","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007268","uid":"00000000-00006312"},{"pid":3352,"ppid":7268,"name":"WerFault.exe","command_line":"-u -p 7268 -s 744","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007268","uid":"00000000-00003352"},{"pid":3840,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 7268 -ip 7268","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003840","icon":"$4e"},{"pid":184,"ppid":0,"name":"RttHlp.exe","command_line":"","sha256":"8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473","normalized_path":"%APPDATA%\\TyfConfig_alpha\\RttHlp.exe","uid":"00000000-00000184","icon":"$4f"},{"pid":7112,"ppid":184,"name":"cmd.exe","command_line":"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00000184","uid":"00000000-00007112"},{"pid":4308,"ppid":7112,"name":"explorer.exe","command_line":"","sha256":"b2b8b4b9a37644531d9d887473f01da2ffedc86938f93349e758ff3598027561","normalized_path":"%WINDIR%\\SysWOW64\\explorer.exe","parent_uid":"00000000-00007112","uid":"00000000-00004308"},{"pid":7360,"ppid":4308,"name":"WerFault.exe","command_line":"-u -p 4308 -s 760","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004308","uid":"00000000-00007360"},{"pid":7332,"ppid":4308,"name":"WerFault.exe","command_line":"-u -p 4308 -s 760","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004308","uid":"00000000-00007332"},{"pid":7616,"ppid":4308,"name":"WerFault.exe","command_line":"-u -p 4308 -s 760","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004308","uid":"00000000-00007616"},{"pid":4712,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 364 -p 4308 -ip 4308","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004712","icon":"$50"}],"all_imported_dlls":["fltLib.dll","api-ms-win-crt-heap-l1-1-0.dll","feclient.dll","uxtheme.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wevtapi.dll","imm32.dll","version.dll","api-ms-win-crt-string-l1-1-0.dll","imagehlp.dll","oleaccrc.dll","api-ms-win-crt-runtime-l1-1-0.dll","ntdll.dll","user32.dll","api-ms-win-core-processthreads-l1-1-1.dll","normaliz.dll","comdlg32.dll","clbcatq.dll","msxml3.dll","pdh.dll","sechost.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","vcruntime140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","nsi.dll","iertutil.dll","mpr.dll","msimg32.dll","tdh.dll","oleaut32.dll","KernelBase.dll","gdi32.dll","dbghelp.dll","msvcrt.dll","shlwapi.dll","cryptbase.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","userenv.dll","setupapi.dll","rpcss.dll","tzres.dll","shdocvw.dll","rpcrt4.dll","ole32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msi.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","VxSSL32.dll","msxml3r.dll","comctl32.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","crypt32.dll","wininet.dll","oleacc.dll","crtdll.dll","pla.dll","api-ms-win-core-timezone-l1-1-0.dll","ws2_32.dll","msasn1.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oledlg.dll","devobj.dll","lpk.dll","msvcp140.dll","bcrypt.dll","profapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","wsock32.dll","kernel32.dll","advapi32.dll","apphelp.dll","cfgmgr32.dll","shell32.dll","msctf.dll","cabinet.dll","ucrtbase.dll","api-ms-win-crt-environment-l1-1-0.dll","Patrial.dll","dwmapi.dll","usp10.dll","srvcli.dll","BitsProxy.dll","wow64cpu.dll","gdi32full.dll","windows.storage.dll","propsys.dll","cldapi.dll","netutils.dll","wtsapi32.dll","win32u.dll","kernel.appcore.dll","TextInputFramework.dll","CoreMessaging.dll","WinTypes.dll","combase.dll","winbrand.dll","cscapi.dll","rmclient.dll","ntmarta.dll","winmm.dll","SHCore.dll","Register.dll","twinapi.appcore.dll","wow64.dll","bcryptprimitives.dll","powrprof.dll","linkinfo.dll","SettingSyncCore.dll","sspicli.dll","winmmbase.dll","CoreUIComponents.dll","IPHLPAPI.DLL","mintdh.dll","aepic.dll","wow64win.dll","msvcp_win.dll","winhttp.dll","cryptsp.dll","ntshrui.dll","twinapi.dll"]},"file_activity":{"dropped_files":[{"name":"acd93848e2d0f95d_hypha.rpm","sha256":"acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]}],"extracted_files":[{"name":"Decrypted Payload","sha256":"0e40c7ee4eeeaa8696d7860ea64c612beb429f7e6daf016d6dd209c6416b2a03","verdict":"malicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe","sha256":"1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"Patrial.dll","sha256":"5c1a3808abb0bd02bc2d1dc11d70abc55ce22a256bcd497c126345be3003821b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"Register.dll","sha256":"87550210bd083496cd991c90dbc6bdb89ee8bf5873f8d8fad8e255c6fc4a5f54","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"RTTHLP.EXE.6A852764.bin","sha256":"8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"rtl120.bpl","sha256":"d6dd7a4f46f2cfde9c4eb9463b79d5ff90fc690da14672ba1da39708ee1b9b50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"vcl120.bpl","sha256":"572edb7d630e9b03f93bd15135d2ca360176c1232051293663ec5b75c2428aec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"DISMHOST.EXE.6A853277.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"RttHlp.exe","sha256":"8aed681ad8d660257c10d2f0e85ae673184055a341901643f27afc38e5ef8473","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"276CBE0CA43AABEC2125A96EB626DD419D0A4EBD275376113D84ADE08BBAA3BF.EXE.6A852743.bin","sha256":"1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"DBRtt.ept","sha256":"483bc8bb54ba240ae356b16a67a1892ebc4bc764db6422c7e862ff90607e1e77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"Breakdown_20260819034716.log","sha256":"479d3dfecf0ac91b81978e17978229b94818c9d258896b3b7ecc3cab121ae183","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"name":"BootstrapperApplicationData.xml","sha256":"3066645428dd243b56d828d7868da52824eb56758a4a0cfc269f500c57695edc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"hypha.rpm","sha256":"acd93848e2d0f95d787832bc7ae21982f90991f9fa91cc66ffcdb75265bc288e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"squirearch.db","sha256":"c69149e6e6e271f7655381ccd513f91eba0f57a2b20b8c4bfbc01a0ca769fc20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"b1ad5aa40c89bce3ed9d22762085fb2b.exe","sha256":"1d46c9a0954cf7bbf696130111fc5968db1436aa1b2fb58fa0dbdd3391d637ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"93d1a912","sha256":"3cfa549fa6ab5f8d8b415a7384b7530ea9842482d0a7a16476dfe5a24c9fff9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"pup","sha256":"9fd04e72a7dcf7381a5953f631ab6e71156250a86aa9e6958e5261d55e3bf2fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"ClientNode1.lnk.bin","sha256":"9fd04e72a7dcf7381a5953f631ab6e71156250a86aa9e6958e5261d55e3bf2fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}],"files_written":[{"path":"%WINDIR%\\Temp\\{5D1B60D1-6B70-4699-B884-44C740C22E09}\\.cr\\276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf.exe","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\Patrial.dll","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\hypha.rpm","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\Register.dll","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\rtl120.bpl","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\RttHlp.exe","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\squirearch.db","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\vcl120.bpl","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{E0656252-8CA5-4893-B1D5-64E5D0998A41}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%TEMP%\\Breakdown_20260819034716.log","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%ALLUSERSPROFILE%\\IObit\\IObitRtt\\DBRtt.ept","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"}]},{"path":"%WINDIR%\\Temp\\{09A47700-80E3-48B9-AB6C-8A9EA332363D}\\.cr\\b1ad5aa40c89bce3ed9d22762085fb2b.exe","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\Patrial.dll","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\hypha.rpm","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\Register.dll","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\rtl120.bpl","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\RttHlp.exe","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\squirearch.db","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\vcl120.bpl","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%WINDIR%\\Temp\\{2352B7E7-66A1-494C-9F54-EFD73EE4346C}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%TEMP%\\Breakdown_20240322074219.log","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%APPDATA%\\TyfConfig_alpha\\Register.dll","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%APPDATA%\\TyfConfig_alpha\\rtl120.bpl","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%APPDATA%\\TyfConfig_alpha\\RttHlp.exe","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%APPDATA%\\TyfConfig_alpha\\squirearch.db","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%APPDATA%\\TyfConfig_alpha\\vcl120.bpl","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%APPDATA%\\TyfConfig_alpha\\hypha.rpm","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%TEMP%\\93d1a912","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%TEMP%\\pup","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"path":"%TEMP%\\ythfxqx","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a850b0c885df8255103942c"},{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4140:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"Local\\SM0:4988:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]},{"name":"SM0:4988:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65fd35cbe93b12f4120726e0"}]}]}},"report_ids":{"sandbox_job_ids":["6a850b0c885df8255103942c","65fd35cbe93b12f4120726e0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 276cbe0ca43a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 276cbe0ca43a…. Malware family: Trojan.Generic. Threat score 100/100. 7/25 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 276cbe0ca43a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 276cbe0ca43a…. Malware family: Trojan.Generic. Threat score 100/100. 7/25 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/276cbe0ca43aabec2125a96eb626dd419d0a4ebd275376113d84ade08bbaa3bf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 276cbe0ca43a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 276cbe0ca43a…. Malware family: Trojan.Generic. Threat score 100/100. 7/25 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]