24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 81:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik.HSQB trojan Sample 27ef8e01f2cc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 27ef8e01f2cc…. Malware family: Win64/GenKryptik.HSQB trojan. Threat score 100/100. 2/27 AV engines flagged this file. 6 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5","keywords":["Malicious","Win64/GenKryptik.HSQB trojan","malware analysis","sandbox report","threat intelligence","27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5"],"about":{"@type":"SoftwareApplication","name":"Quark_X64.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/GenKryptik.HSQB trojan","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T165b,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC913000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp")26:Td55,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006776.00000003.153393.DF553000.00000002.mdmp")27:T1d4f,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC913000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC913000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC913000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006776.00000003.153393.DF553000.00000002.mdmp")28:T48c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC913000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp")29:Tf38,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC913000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp, 00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp, 00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp, 00000000-00006776.00000003.153393.CCA09000.00000002.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.DF553000.00000002.mdmp")2a:T4aa,Found PE header "MZ" - Source: "00000000-00006776.00000001.146189.CC590000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CC500000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CC590000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CC740000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CC9C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CCA70000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000002.148108.CCFC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000003.153393.CC590000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000003.153393.CC9C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006776.00000003.153393.CCA70000.00000004.mdmp")2b:Ta5a," HTTP/2 200 OK Content-Type: image/png Date: Fri 03 Jul 2026 10:38:54 GMT X-Azure-Ref: 20260703T034035Z-r169886db7bqktc8hC1CH1c5u400000001ng000000007294 X-Cache-Remote: TCP_MEM_HIT from a23-192-164-209.deploy.akamaitechnologies.com (AkamaiGHost/22.5.4-b620ca40a6c21d08122eeb20d0541579) (-) X-Bm-Fe-Elapsed: 36 Access-Control-Allow-Headers: Content-Type X-FD-Features X-FD-FLIGHT PreferAnonymous X-Ms-Bm-Ws-Info: 0 Access-Control-Allow-Methods: POST GET OPTIONS Access-Control-Allow-Origin: * X-Bm-Traceid: eff8e2c72d092c67124590d114c212ff X-Bm-Srv: mapsplatform-frontend-7f44458bbb-sxlmx mapsplatform-imagery-service-9c67f5fd-tbv6z Cache-Control: public max-age=59829 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Aks_4209_weight: 100 with response body ==>BINARY_CONTENT.......4d:Tfd4,"nul 2>&1\" (Indicator: \"sc start\"; Source: \"00000000-00006776.00000000.144268.80021000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"wincfg.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"wincfg.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006776)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: AliyunWrap_original.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: AliyunWrap.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"C:\\Windows\\System32\\drivers\\*.sys\" (Indicator: \"\\drivers\\\"; File: \"27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin\")\n Found string \"C:\\Windows\\System32\\drivers\\*.sys\" (Indicator: \"system32\\drivers\"; File: \"27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006776.00000000.144268.CA360000.00000004.mdmp, 00000000-00006776.00000001.146189.CA360000.00000004.mdmp, 00000000-00006776.00000002.148108.CA360000.00000004.mdmp, 00000000-00006776.00000003.153393.CA360000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006776.00000000.144268.CA360000.00000004.mdmp, 00000000-00006776.00000001.146189.CA360000.00000004.mdmp, 00000000-00006776.00000002.148108.CA360000.00000004.mdmp, 00000000-00006776.00000003.153393.CA360000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin\")\n Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00006776.00000003.153393.DF553000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006776.00000000.144268.80021000.00000002.mdmp, 00000000-00006776.00000001.146189.CC590000.00000004.mdmp, 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CC500000.00000004.mdmp, 00000000-00006776.00000002.148108.CC590000.00000004.mdmp, 00000000-00006776.00000002.148108.CC740000.00000040.mdmp, 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp, 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp, 00000000-00006776.00000003.153393.CC590000.00000004.mdmp, 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp, 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"00000000-00006776.00000002.148108.9ABBC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"oftware\\Classes\\CLSID\\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\\InprocServer32\" (Indicator: \"{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\") in Source: 00000000-00006776.00000000.144268.CA360000.00000004.mdmp\n 00000000-00006776.00000001.146189.CA360000.00000004.mdmp\n Observed string: \"SOFTWARE\\Classes\\CLSID\\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\" (Indicator: \"{B5F8350B-0548-48B1-A6EE-88BD00B4A5E7}\") in Source: 00000000-00006776.00000001.146189.CC590000.00000004.mdmp\n 00000000-00006776.00000001.146189.CC7A0000.00000040.mdmp\n 00000000-00006776.00000002.148108.CC500000.00000004.mdmp\n 00000000-00006776.00000002.148108.CC590000.00000004.mdmp\n 00000000-00006776.00000002.148108.CC740000.00000040.mdmp\n 00000000-00006776.00000002.148108.CC7A0000.00000040.mdmp\n 00000000-00006776.00000002.148108.CCA70000.00000004.mdmp\n 00000000-00006776.00000003.153393.CC590000.00000004.mdmp\n 00000000-00006776.00000003.153393.CC7A0000.00000040.mdmp\n 00000000-00006776.00000003.153393.CCA70000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"wincfg.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: AliyunWrap_original.dll]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$74","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a479092857820fe170c4f1d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"