21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious FormBook.Generic Sample 2a005539d78a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2a005539d78a…. Malware family: FormBook.Generic. Threat score 100/100. 18/23 AV engines flagged this file. 25 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","keywords":["Malicious","FormBook.Generic","malware analysis","sandbox report","threat intelligence","2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029"],"about":{"@type":"SoftwareApplication","name":"rStatementofAccountasat30MAY-JUN2024.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"FormBook.Generic","antivirusDetections":{"malicious":18,"total":23},"behavioralIndicators":{"malicious":25,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC23:Tdeb,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")24:T7ec,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES")25:T54b,Found string "+ncalrpc:[OLEED61FA2A418CC7A96DB8A466183D]" (Indicator: "ncalrpc"; Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "B+ncalrpc:[OLEED61FA2A418CC7A96DB8A466183D]" (Indicator: "ncalrpc"; Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "+ncalrpc:[OLEC68CE6B4DDF5FCFBCE5E63F09A05]" (Indicator: "ncalrpc"; Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "B+ncalrpc:[OLEED61FA2A418C" (Indicator: "ncalrpc"; Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp") Found string "+ncalrpc:[OLEA2B1A3F17EDABBD999C2A20489B4]" (Indicator: "ncalrpc"; Source: "00000000-00008300.00000000.98355.02A90000.00000004.mdmp")26:T5a7,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")27:T67e,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005640-00000C2C-181794792") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp")28:T8b0,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe.config" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\bquP\" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe.Local\" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:Zone.Identifier" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\2A005539D78A0C685832AFFB3BFBFBA01DE751FA8B6CDF02BECDDABFC89B9029.EXE.CONFIG" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\BQUP" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\2A005539D78A0C685832AFFB3BFBFBA01DE751FA8B6CDF02BECDDABFC89B9029.INI"29:T678,"rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POSTBOX\PROFILES.INI" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\CLAWS-MAIL" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA MAIL\OPERA MAIL\WAND.DAT" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%APPDATA%\THUNDERBIRD\PROFILES.INI" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%APPDATA%\POSTBOX\PROFILES.INI" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%APPDATA%\CLAWS-MAIL" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%APPDATA%\OPERA MAIL\OPERA MAIL\WAND.DAT" "rStatementofAccountasat30MAY-JUN2024.exe" trying to open a file "%APPDATA%\POCOMAIL\ACCOUNTS.INI"2a:Teac,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005576)2b:T86c,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ExecuteReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_TabIndex" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "add_TabIndexChanged" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "DbConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "set_ActiveLinkColor" (Indicator: "link"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SqlDataReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "txtusername_TabIndexChanged" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "add_LinkClicked" (Indicator: "link"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadAllText" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Synchronized" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "LinkLabelLinkClickedEventArgs" (Indicator: "link"; Source: "sample.bin"), Found reference to API "Exit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "Read" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SqlConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "Close" (Indicator: "close"; Source: "sample.bin"), Found reference to API "DbDataReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "LinkLabelLinkClickedEventHandler" (Indicator: "link"; Source: "sample.bin"), Found reference to API "3HyBrK" (Indicator: "brk"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "linkLabel1_LinkClicked" (Indicator: "link"; Source: "sample.bin")2c:T6e5,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"2d:T9ab,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN")2e:T1449,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "HMAC"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA512" (Indicator: "SHA512"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "00005924.00001724.17601745.00402000.wprm") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp")2f:Tb7f,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")30:Tb52,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "00005924.00001724.17601745.00402000.wprm") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00005924.00000000.74961.00400000.00000040.mdmp")31:Tcf7,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\FLTLIB.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\MSVCP140.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\ucrtbase.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"32:T85b8,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005576.00000001.74663.7F6F0000.00000002.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "pera Software\Opera Stable" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005924.00000001.76887.00260000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005924.00000001.76887.00260000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Opera Software\Opera Stable" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\11.0\Outlook\Pro4" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\12.0\Outlook\Pro" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\14.0\Outlook\Pro" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Pro" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Pro|" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Pro" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\ActiveSync\Partners" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\ActiveSync\Part" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\RimArts\B2\Settings" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\RimArts\B2\Setth" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\IncrediMail\Identities\" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\IncrediMail\Ident" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Qualcomm\Eudora\CommandLine\" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Qualcomm\Eudora\Command" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Aerofox\FoxmailPreview" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Aerofox\FoxmailPrx" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Aerofox\FoxmailT" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Martin Prikryl\WinSCP 2\Ses" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\FTPWare\COREFTP\Sites" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\FTPWare\COREFTP\S" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\OpenVPN-GUI\configs" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\OpenVPN-GUI\configs\" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\OpenVPN-GUI\con" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\RealVNC\vncserver" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\TightVNC\Server" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Wow6432Node\RealVNC\WinVNC4" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\ORL\WinVNC3" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\RealVNC\WinVNC4" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\TigerVNC\Server" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\Wow6432Node\RealVNC\Win" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\RealVNC\vncse" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "SOFTWARE\RealVNC\Win" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\ORL\Win" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\TightVNC\Se" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\TigerVNC\Se" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\DownloadManager\Passwords\" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Login Data" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Login Data" in Source: 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpUseEtherSNAP" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|DefaultGateway" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|EnableDHCP" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseObtainedTime" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|DhcpServer" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDNS" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterSecurityEnabled" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|RawIPAllowedProtocols" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TCPAllowedPorts" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UDPAllowedPorts" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|SubnetMask" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcast" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktType" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|MediaType" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|NetworkNumber" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ScopeID" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableDNS" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableLMHOSTS" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|ScopeID" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|TCPAllowedPorts" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|UDPAllowedPorts" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|RawIPAllowedProtocols" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|NetworkNumber" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|PktType" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Se" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Ss" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilte" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|I" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSetF" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tc" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "istry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameter" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\ParamD" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktTyp" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpi" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\Netw" in Source: 00000000-00005924.00000001.76887.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|NetworkNumber" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ScopeID" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSetN" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcs" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Servi" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\`" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "try|SYSTEM\CurrentControlSet\SE" in Source: 00000000-00005924.00000001.76887.04814000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpUseEtherSNAP" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|DefaultGateway" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|EnableDHCP" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseObtainedTime" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|DhcpServer" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDNS" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterSecurityEnabled" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|RawIPAllowedProtocols" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TCPAllowedPorts" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UDPAllowedPorts" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|SubnetMask" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcast" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktType" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|MediaType" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|NetworkNumber" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ScopeID" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableDNS" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableLMHOSTS" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|ScopeID" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|TCPAllowedPorts" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|UDPAllowedPorts" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|RawIPAllowedProtocols" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|NetworkNumber" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|PktType" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Se" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Ss" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilte" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|I" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSetF" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tc" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "istry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameter" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\ParamD" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktTyp" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpi" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\Netw" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSetN" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcs" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Servi" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\`" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp "try|SYSTEM\CurrentControlSet\SE" in Source: 00000000-00005924.00000002.78810.047F6000.00000004.mdmp33:T1df2,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000030002c0030002c002c0031003500630038000d000a0000002c0030002c0040003200360065006500370038002c003200370036002c0031006300300031003000300030003000300036003000300030003000300030003000310030003000300030003000300062003100310064003000 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310076f5f66c7755164377f42ed771603b3800a035d771051643778ce8260018163800b2f46c77751643779ce826000000d0710000d07100000000f8e72600f0000000f000d0710000000008e82600530000009ce9260000000000010000006ce8260040f56c77000000000000000058e82600 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47007480b13f008c4700740000000080b13f00ccdf2600086d6c77188174770000000080e0260000000000de54d1640ce0260095e16877f1ef0900feffffff6b2c6d7731198675021000000000000000000100e0df2600c89f6c778c4700740000000000000000 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe4761839420000b0fd7f9a5c6d770080fd7fccc2c30444b0fd7f00000000400000003f0000002a00000000b0fd7fc0c2c304c15c6d77608274772a00000000b0fd7f9a5c6d770080fd7fe4c2c30457896c778083747713178675d8ebe476 (UID: 00000000-00005576) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006e006f00740069006600690063006100740069006f006e00650078000000680065006c006c005c00760031000d00000d53fb0000b8f83d0038ae3d007300680065006c006c002e0065007800650000000000000000000000000000000700000749fb0000b8f83d0038ae3d0000000000 (UID: 00000000-00005640) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000195e168771c390900fefffffff5f66c77634d6d77281e3d001015417188084100b2f46c7768db3576f4ea50010000407100004071804d6d774cdb3576f0000000f00040710000000060ea50015c004300f4eb50010000000001000000c4ea500140f56c770000000000000000b0ea5001 (UID: 00000000-00005640) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a60ea5001010000000000000000008a77000000004cea500100000000000000000000000060ea500100000000000000000000000072b5fd4854ea500103000000000000008800000000008a7760ea5001459d9d750000180000000000800000000200000000005101dc1a407174ea5001 (UID: 00000000-00005640) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005640) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe47698a0320400f0fd7f9a5c6d7700f0fa7fa0d2de0444f0fd7f00000000400000003f0000002500000000f0fd7f94d2de04c15c6d77608274772500000000f0fd7f9a5c6d7700f0fa7fb8d2de0457896c778083747713178675d8ebe476 (UID: 00000000-00005640) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000220000000000000000000000240000000d0000000000000001000000c4e42a0080000000000000000000000022000000000000000000000024000000020000000000000000000000c8e52a00180000000000000000000000220000000000000000000000240000000d00000000000000 (UID: 00000000-00005932) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e1687718310900fefffffff5f66c77634d6d77d81d29001015417188084100b2f46c771cd50a7744ed6f000000407100004071804d6d77f8d40a77f0000000f000407100000000b0ec6f005c00430044ee6f00000000000100000014ed6f0040f56c77000000000000000000ed6f00 (UID: 00000000-00005932) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006ab0ec6f00010000000000000000008a77000000009cec6f00000000000000000000000000b0ec6f0000000000000000000000000031dc0249a4ec6f0003000000000000008800000000008a77b0ec6f00459d9d7500003e0000000000800000000200000000007000dc1a4071c4ec6f00 (UID: 00000000-00005932) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005932) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebe47658e407050050fd7f9a5c6d7700f0fa7f20d7cd044450fd7f00000000400000003f000000250000000050fd7f14d7cd04c15c6d7760827477250000000050fd7f9a5c6d7700f0fa7f38d7cd0457896c778083747713178675d8ebe476 (UID: 00000000-00005932) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300688a3200110000115737000088843300f8ca3200b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031009e28f1c704b29c27773437336a000000000100000000000000010000004cf1c704000000002812ea0188f1c704c01a3b0058f1c7048f9c27773437336a020000000000000018000000010000005cf1c7042823e86900002e00000000000c0000006002f20168f1c7042f99336a0c000000 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000d0370020223b00004c3800300000000000000060f2190050dc3d77004c380030000000044c3800000000003000000094f219006eaa726dd8da716d0200000000000000180000002812ea0194f219002823e86900002e00000000000c000000f8266c6da0f219002f99336a0c000000 (UID: 00000000-00005924)34:Ta40,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")35:Te6e,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "2A005539D78A0C685832AFFB3BFBFBA01DE751FA8B6CDF02BECDDABFC89B9029"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "")36:T637,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to perform cryptographic operations Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - Customized RC4 encryption for MSIL37:T5d6,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00006652.00000001.100321.00400000.00000040.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008756.00000000.97935.02FD0000.00000004.mdmp")38:T96e,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\SHELL\REGISTEREDAPPLICATIONS\URLASSOCIATIONS\DIRECTORY\OPENWITHPROGIDS") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\SHELL\ASSOCIATIONS\URLASSOCIATIONS\DIRECTORY") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERY"; Path: "HKCU\DIRECTORY") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\CURVER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\CURVER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\DIRECTORY\SHELLEX\ICONHANDLER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\ICONHANDLER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\FOLDER\SHELLEX\ICONHANDLER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\ICONHANDLER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS")39:T116e,Found XOR loop in file "oNWwWxxYw.exe" at offset 88074; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 148878; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 164708; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 185703; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 214711; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 263658; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 311846; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 334777; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 416970; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 423421; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 463818; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 488869; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 511725; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 514055; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 665901; code bytes = 30d0 Found XOR loop in file "oNWwWxxYw.exe" at offset 46822; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 66247; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 108545; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 109940; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 138976; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 180835; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 204266; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 318141; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 381621; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 510698; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 609467; code bytes = 33c1 Found XOR loop in file "oNWwWxxYw.exe" at offset 106184; code bytes = 8030 Found XOR loop in file "oNWwWxxYw.exe" at offset 199112; code bytes = 8030 Found XOR loop in file "oNWwWxxYw.exe" at offset 225310; code bytes = 8030 Found XOR loop in file "oNWwWxxYw.exe" at offset 505435; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 88074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 148878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 164708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 185703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 214711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 263658; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 311846; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 334777; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 416970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 423421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 463818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 488869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 511725; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 514055; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 665901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 46822; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 66247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 108545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 109940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 138976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 180835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 204266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 318141; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 381621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 510698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 609467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 106184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 199112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225310; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 505435; code bytes = 80303a:Tc0c,"rStatementofAccountasat30MAY-JUN2024.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00008756) "rStatementofAccountasat30MAY-JUN2024.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008756)3b:T520,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005640-00000C2C-183099945") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005640-00000C2C-183497072") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005640-00000C2C-183597891") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005640-00000C2C-183597891") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005640-00000C2C-183597891") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005640-00000C2C-184511406") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005640-00000C2C-184511406") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005640-00000C2C-184647927") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005640-00000C2C-184648408") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005640-00000C2C-184658675") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005640-00000C2C-184659319")3c:T4e8,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005576) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005640) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005640) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005932) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005932) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005924)3d:T187b,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBrowser\" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\EDGE\USER DATA" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\NETGATE TECHNOLOGIES\BLACKHAWK\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\K-MELEON\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MOONCHILD PRODUCTIONS\PALE MOON\PROFILES.INI" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES.INI"3e:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}3f:T53c,"SOFTWARE\FTPWare\COREFTP\Sites" (Indicator: "software\ftpware\coreftp\sites") "P Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "\Ftplist.txt" (Indicator: "ftplist.txt") "rtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "rtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") ")\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") ")\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "cftp\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt")40:T18ec,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:c0000135]41:T1022,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005576-00000C2B-157216508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005576-00000C2B-157583076] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005576-00000C2B-158819542] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005576-00000C2B-158996924] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005576-00000C2B-159302382] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005576-00000C2B-159646719] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005576-00000C2B-159797280] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005576-00000C2B-160163035] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005576-00000C2B-160256854] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005576-00000C2B-160338001] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005576-00000C2B-160447085] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005576-00000C2B-160679734] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005576-00000C2B-160911752] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005576-00000C2B-160983214] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005576-00000C2B-161066661] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005576-00000C2B-161138952] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005576-00000C2B-161553233] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00005576-00000C2B-162531906] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005576-00000C2B-163305863] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005576-00000C2B-163391949] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005576-00000C2B-163475604] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005576-00000C2B-164385531] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005576-00000C2B-165606089] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005640-00000C2B-169347830] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005640-00000C2B-169572312]42:T60c,"Office\11.0\Outlook\Profiles" in Source: 00005924.00001724.17601745.00402000.wprm "2.0\Outlook\Profiles" in Source: 00005924.00001724.17601745.00402000.wprm "Office\14.0\Outlook\Profiles" in Source: 00005924.00001724.17601745.00402000.wprm "5.0\Outlook\Profiles" in Source: 00005924.00001724.17601745.00402000.wprm "16.0\Outlook\Profiles" in Source: 00005924.00001724.17601745.00402000.wprm "irtualStore\Program Files\Foxmail\mail" in Source: 00005924.00001724.17601745.00402000.wprm "il\Opera Mail\wand.dat" in Source: 00005924.00001724.17601745.00402000.wprm "\Thunderbird\" in Source: 00005924.00001724.17601745.00402000.wprm "oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "VirtualStore\Program Files\Foxmail\mail" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "Opera Mail\Opera Mail\wand.dat" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp43:Tf23,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00008756-00000C25-534840924] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00008756-00000C25-535579371] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00008756-00000C25-535686801] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008756-00000C25-535760884] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00008756-00000C25-535878806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00008756-00000C25-535920565] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008756-00000C25-535972464] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00008756-00000C25-536073679] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00008756-00000C25-536150303] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00008756-00000C25-536238118] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00008756-00000C25-536403686] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00008756-00000C25-536555564] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00008756-00000C25-536587668] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00008756-00000C25-536649979] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00008756-00000C25-536927754] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008756-00000C25-537655535] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008756-00000C25-537680396] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00008756-00000C25-537705302] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00008756-00000C25-537929529] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00008756-00000C25-538079101] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00008756-00000C25-538182462] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008756-00000C25-539730811] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008916-00000C25-543113210] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008916-00000C25-544786576] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008916-00000C25-545169786]44:T40d,"rStatementofAccountasat30MAY-JUN2024.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1764) "rStatementofAccountasat30MAY-JUN2024.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1536) "rStatementofAccountasat30MAY-JUN2024.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1548) "rStatementofAccountasat30MAY-JUN2024.exe" wrote 00000004 bytes to a remote process "C:\rStatementofAccountasat30MAY-JUN2024.exe" (Handle: 1768) "rStatementofAccountasat30MAY-JUN2024.exe" wrote 00000200 bytes to a remote process "C:\rStatementofAccountasat30MAY-JUN2024.exe" (Handle: 1768) "rStatementofAccountasat30MAY-JUN2024.exe" wrote 0003A200 bytes to a remote process "C:\rStatementofAccountasat30MAY-JUN2024.exe" (Handle: 1768) "rStatementofAccountasat30MAY-JUN2024.exe" wrote 00000600 bytes to a remote process "C:\rStatementofAccountasat30MAY-JUN2024.exe" (Handle: 1768)45:T9c6,"rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FILEZILLA\RECENTSERVERS.XML" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\FTP NAVIGATOR\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\SMARTFTP\CLIENT 2.0\FAVORITES\QUICK CONNECT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\ROAMINGIPSWITCH\WS_FTP\SITES\WS_FTP.INI" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Program Files (x86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Program Files (x86)\FTP COMMANDER\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\CFTP\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FTPGETTER\SERVERS.XML" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%LOCALAPPDATA%\MAPLESTUDIO\CHROMEPLUS\USER DATA" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%APPDATA%\POCOMAIL\ACCOUNTS.INI" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%APPDATA%\FILEZILLA\RECENTSERVERS.XML" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%APPDATA%\SMARTFTP\CLIENT 2.0\FAVORITES\QUICK CONNECT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%APPDATA%\PSWITCH\WS_FTP\SITES\WS_FTP.INI" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%PROGRAMFILES%\(x86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%PROGRAMFILES%\(x86)\FTP COMMANDER\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "rStatementofAccountasat30MAY-JUN2024.exe" opened file "%APPDATA%\FTPGETTER\SERVERS.XML"46:T178e,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")47:T1046,Found string "\\DESKTOP-FVVF82A\ROOT\cimv2:Win32_Processor" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000000.98400.04F70000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\cimv2:Win32_BaseBoard" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_BaseBoard.Tag="Base Board"" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000000.98400.04F70000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_BaseBoard.Tag="Base Board"" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "ROOT\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\cimv2:Win32_Processor" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp") Found string "ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.033F0000.00000004.mdmp, 00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000001.100321.034D4000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.034D4000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00006652.00000000.98400.04F70000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.04F70000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\cimv2:Win32_BaseBoard" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000000.98400.04F70000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\cimv2:Win32_NetworkAdapterConfiguration" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=12" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Processor.DeviceID="CPU1"" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000001.100321.033F0000.00000004.mdmp, 00000000-00006652.00000002.102239.033F0000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Processor.DeviceID="CPU1"" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\cimv2:Win32_NetworkAdapterConfiguration" (Indicator: "root\cimv2"; in Source: "00000000-00006652.00000001.100321.03490000.00000004.mdmp, 00000000-00006652.00000002.102239.03490000.00000004.mdmp")48:T142c,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" queries volume information of "C:\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" at 00000000-00005576-0000010C-3483704 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005640-0000010C-4718878 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005640-0000010C-6248727 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005640-0000010C-7785322 "powershell.exe" queries volume information of "C:\share" at 00000000-00005640-0000010C-7787160 "powershell.exe" queries volume information of "C:\share" at 00000000-00005640-0000010C-8020255 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00005640-0000010C-10503653 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00005640-0000010C-10542673 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00005640-0000010C-10546310 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00005640-0000010C-10550016 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll" at 00000000-00005640-0000010C-10553590 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00005640-0000010C-10945757 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00005640-0000010C-11310063 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00005640-0000010C-21882132 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00005640-0000010C-21891390 "powershell.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00005640-0000010C-21964297 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005932-0000010C-5014191 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005932-0000010C-5767297 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005932-0000010C-7023781 "powershell.exe" queries volume information of "C:\share" at 00000000-00005932-0000010C-7025324 "powershell.exe" queries volume information of "C:\share" at 00000000-00005932-0000010C-7211181 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00005932-0000010C-9807703 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00005932-0000010C-9814118 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00005932-0000010C-9817445 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00005932-0000010C-982091349:Tc509,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005640) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\d254c63bedcb76c81c3125bd527b7d1a\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\73a1a80aed03e789a49cec899b7505dd\System.Management.Automation. (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\05765f777020deeddc8ad54b48343b9c\Microsoft.PowerShell.Security (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\f0821980bfe2fc8375ccfc37dbe6e9d8\Microsoft.Management.Infrastr (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\8dcf1daed985f481eed5cca9d2945c18\Microsoft.PowerShell.Commands (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005932) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005932) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005960) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005960) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005924) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005924)4a:T80e,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005576) "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002600cc416d77509b3900a0000000fe030000ff2b6c77710e4377940000002402340000003400320016000100000000000000000000001300000001000000330002000100000004000000010000000000000000000000086d3400f81f0000940000000000000000000000a0ed3700f8693400546b3400689b3900d874340000000000bcef26000000000080f5260095e1687721e20900feffffffff2b6c779a2a6c779400000004f12600fdfeea76e4e926000100000080f52600a2e08d6a25d80828feffffff9cf026005c9c8d6a5c0c0000b0f026006f9c8d6a0000000000000000 (UID: 00000000-00005576)4b:T6e1,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005576.00000000.73833.00340000.00000004.mdmp, 00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string "system32\drivers\NetMon.sys" (Indicator: "\drivers\"; Source: "00000000-00005576.00000000.73833.012A0000.00000002.mdmp") Found string "system32\drivers\NetMon.sys" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000000.73833.012A0000.00000002.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005576.00000001.74663.00340000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005924.00000000.74961.002E0000.00000004.mdmp, 00000000-00005924.00000001.76887.002E0000.00000004.mdmp, 00000000-00005924.00000002.78810.002E0000.00000004.mdmp")4c:T949,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "oNWwWxxYw.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"4d:Tc70,Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_To" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailAddressCollection" and MemberReference "Add" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailAddress" and MemberReference ".ctor" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_From" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Port" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_DeliveryMethod" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "Send" in "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_To" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.MailAddressCollection" and MemberReference "Add" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.MailAddress" and MemberReference ".ctor" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_From" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Port" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_DeliveryMethod" in "oNWwWxxYw.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "oNWwWxxYw.exe"4e:Tcfc,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\FLTLIB.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\MSVCP140.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\VCRUNTIME140.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\ucrtbase.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"4f:T736,"Software\IncrediMail\Identities\" in Source: 00005924.00001724.17601745.00402000.wprm "Software\Qualcomm\Eudora\CommandLine\" in Source: 00005924.00001724.17601745.00402000.wprm "SOFTWARE\FTPWare\COREFTP\Sites" in Source: 00005924.00001724.17601745.00402000.wprm "URRENT_USER\Software\RimArts\B2\Settings" in Source: 00005924.00001724.17601745.00402000.wprm "HKEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00005924.00001724.17601745.00402000.wprm "SOFTWARE\RealVNC\vncserver" in Source: 00005924.00001724.17601745.00402000.wprm "Software\TightVNC\Server" in Source: 00005924.00001724.17601745.00402000.wprm "Software\Brave-Browser\User Data" in Source: 00005924.00001724.17601745.00402000.wprm "Opera Software\Opera Stable" in Source: 00005924.00001724.17601745.00402000.wprm "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005576.00000001.74663.7F6F0000.00000002.mdmp "KEY_CURRENT_USER\Software\RimArts\B2\Settings" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "KEY_CURRENT_USER\Software\Aerofox\FoxmailPreview" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "KEY_CURRENT_USER\Software\Aerofox\Foxmail\V3.1" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "raveSoftware\Brave-Browser\User Data" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp "pera Software\Opera Stable" in Source: 00000000-00005924.00000000.74961.00400000.00000040.mdmp50:T4b86,"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c70000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "KERNEL32" at base 76e60000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "ADVAPI32.DLL" at base 76820000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bbb0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "SHLWAPI.DLL" at base 777f0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "VERSION.DLL" at base 74a10000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64c20000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "USER32.DLL" at base 75a80000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "MSCOREE.DLL" at base 6bc40000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "PSAPI.DLL" at base 75910000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "RPCRT4.DLL" at base 76d60000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "KERNEL32.DLL" at base 76e60000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63810000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "OLE32.DLL" at base 77230000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "CRYPTBASE.DLL" at base 75470000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74400000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 722a0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62db0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a6f0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61f40000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "UXTHEME.DLL" at base 743b0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61720000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a4d0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60fa0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72280000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "NTDLL.DLL" at base 77670000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "SHELL32.DLL" at base 75b50000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 777d0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "PROFAPI.DLL" at base 75590000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "BCRYPT.DLL" at base 75090000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "CRYPTSP.DLL" at base 74f80000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d10000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "IMM32.DLL" at base 778a0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "COMCTL32.DLL" at base 71d00000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "GDI32.DLL" at base 77850000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "GDIPLUS.DLL" at base 73e90000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73e90000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76e60000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "WINDOWSCODECS.DLL" at base 73920000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6a2e0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "NTDLL" at base 77670000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "PROPSYS.DLL" at base 74030000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "COMCTL32.DLL" at base 74440000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "OLEAUT32.DLL" at base 77390000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "APPHELP.DLL" at base 75420000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "CLBCATQ.DLL" at base 768d0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a900000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "SETUPAPI.DLL" at base 77090000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74030000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "NTMARTA.DLL" at base 749e0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 755a0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76f40000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "SECUR32.DLL" at base 752b0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 758a0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75420000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "SSPICLI.DLL" at base 75400000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 777d0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "RPCRTREMOTE.DLL" at base 75510000 "powershell.exe" loaded module "PSAPI.DLL" at base 75910000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76d60000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76e60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bc40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63810000 "powershell.exe" loaded module "OLE32.DLL" at base 77230000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75470000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62db0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 6a660000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74f80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d10000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5f4b0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77670000 "powershell.exe" loaded module "VERSION.DLL" at base 74a10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72280000 "powershell.exe" loaded module "SHELL32.DLL" at base 75b50000 "powershell.exe" loaded module "USER32.DLL" at base 75a80000 "powershell.exe" loaded module "WINTRUST.DLL" at base 756e0000 "powershell.exe" loaded module "MSISIP.DLL" at base 743f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75720000 "powershell.exe" loaded module "IMM32.DLL" at base 778a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 71400000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 713f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5e580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5f150000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6bc40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60fa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69bc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 68740000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74400000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 722a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6b670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 68540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6a710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6a590000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6b8c0000 "powershell.exe" loaded module "SECUR32.DLL" at base 752b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 75400000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 777f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 6a3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 777d0000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 6a360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 62a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6c1c0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 755a0000 "powershell.exe" loaded module "URLMON.DLL" at base 76f40000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 758a0000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 703c0000 "powershell.exe" loaded module "NCRYPT.DLL" at base 750b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74c50000 "powershell.exe" loaded module "USERENV.DLL" at base 755b0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 777d0000 "powershell.exe" loaded module "GPAPI.DLL" at base 74b50000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 777d0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 777d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71bb0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71bb0000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6b790000 "powershell.exe" loaded module "WINHTTP.DLL" at base 71300000 "powershell.exe" loaded module "WS2_32.DLL" at base 769a0000 "powershell.exe" loaded module "CREDSSP.DLL" at base 74c10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f40000 "powershell.exe" loaded module "WSHTCPIP" at base 74aa0000 "powershell.exe" loaded module "WSHIP6.DLL" at base 74f30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 71da0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 738d0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base 737e0000 "powershell.exe" loaded module "DHCPCSVC.DLL" at base 73760000 "powershell.exe" loaded module "NSI.DLL" at base 759c0000 "powershell.exe" loaded module "CFGMGR32.DLL" at base 756a0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 777d0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75590000 "powershell.exe" loaded module "DNSAPI.DLL" at base 74e00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74aa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74f30000 "powershell.exe" loaded module "RASADHLP.DLL" at base 71ba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73840000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75720000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 62910000 "powershell.exe" loaded module "GDI32.DLL" at base 77850000 "powershell.exe" loaded module "BCRYPT.DLL" at base 75090000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 743b0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 76d60000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 777d0000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76820000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 768d0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73b80000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75400000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72220000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 62c00000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5d710000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a790000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69bc0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6d2b0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d610000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6a330000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6d2e0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d6c0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "OLEAUT32" at base 77390000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "VAULTCLI.DLL" at base 6c5f0000 "2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 69ae000051:T563,YARA signature "INDICATOR_EXE_Packed_SmartAssembly" matched process "00000000-00005576" as "Detects executables packed with SmartAssembly" YARA signature "INDICATOR_EXE_Packed_GEN01" matched process "00000000-00005924" as "Detect packed .NET executables. Mostly AgentTeslaV4." YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched process "00000000-00005924" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." YARA signature "INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store" matched process "00000000-00005924" as "Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients" matched process "00000000-00005924" as "Detects executables referencing many email and collaboration clients. Observed in information stealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients" matched process "00000000-00005924" as "Detects executables referencing many file transfer clients. Observed in information stealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID" matched process "00000000-00005924" as "Detects executables referencing Windows vault credential objects. Observed in infostealers"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["infostealer","evasive","windows-server-utility"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"verdict":"undetected"},{"name":"tmp5F85.tmp","sha256":"d1bcba313caf5d5418a2fa96aa679914581002246c4309d76db55e66ebab1958","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"verdict":"undetected"},{"name":"powershell.exe.log","sha256":"8013f6cd1a83fa23f56b9e4a135621af9feeb6ddbfd794ed0b7e7cb6b7ddd665","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"verdict":"undetected"},{"name":"rStatementofAccountasat30MAY-JUN2024.exe.log","sha256":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"verdict":"undetected"},{"name":"oNWwWxxYw.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"verdict":"undetected"},{"name":"oNWwWxxYw.exe","sha256":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"verdict":"malicious"},{"name":"tmpB78B.tmp","sha256":"4decc71c4ab9eec877623b11bd8807dd78f1cb61b405508a3e9eab176168e4a3","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"verdict":"undetected"},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%TEMP%\\__PSScriptPolicyTest_a0z3ppjy.gns.psm1","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\welcqnln.3bd.ps1","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"path":"%APPDATA%\\oNWwWxxYw.exe:Zone.Identifier","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_zfxs5tsc.aus.ps1","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ob132e4j.30n.ps1","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\httrxwjg.ssl.psm1","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"path":"%TEMP%\\fnv4mnsi.iap.psm1","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xag4usxb.2o4.psm1","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\tmpB78B.tmp","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\tmp5F85.tmp","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"C:\\DRIVERS\\ETC\\HOSTS","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%APPDATA%\\oNWwWxxYw.exe","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"path":"%TEMP%\\vmgffarz.3aa.ps1","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\rStatementofAccountasat30MAY-JUN2024.exe.log","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"SM0:8756:168:WilStaging_02","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"SM0:8300:168:WilStaging_02","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"name":"Local\\SM0:8756:64:WilError_01","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\SM0:8916:168:WilStaging_02","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\SM0:8300:64:WilError_01","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\SM0:8300:168:WilStaging_02","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"name":"SM0:8756:64:WilError_01","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\SM0:8756:168:WilStaging_02","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"SM0:8916:64:WilError_01","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\SM0:8916:64:WilError_01","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"SM0:8916:168:WilStaging_02","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"name":"SM0:8300:64:WilError_01","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"embedded_urls":[{"sources":[{"report_id":"","report_type":"qsp"}],"value":"smtp://mail.commtechtrading.com:587"}],"http_requests":[]},"process_activity":{"all_imported_dlls":["wintrust.dll","bcryptprimitives.dll","Microsoft.PowerShell.Commands.Management.ni.dll","api-ms-win-crt-runtime-l1-1-0.dll","powrprof.dll","crypt32.dll","shlwapi.dll","wship6.dll","cryptsp.dll","System.Transactions.dll","vcruntime140_clr0400.dll","Microsoft.PowerShell.Security.ni.dll","wow64cpu.dll","System.Drawing.ni.dll","dhcpcsvc6.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","pwrshsip.dll","wmidcom.dll","SHCore.dll","advapi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","psapi.dll","OneCoreUAPCommonProxyStub.dll","msctf.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","ws2_32.dll","System.Configuration.Install.ni.dll","amsi.dll","RpcRtRemote.dll","dhcpcsvc.dll","mscorrc.dll","cfgmgr32.dll","api-ms-win-crt-filesystem-l1-1-0.dll","uxtheme.dll","KernelBase.dll","win32u.dll","api-ms-win-core-synch-l1-2-0.dll","lpk.dll","ntmarta.dll","vcruntime140.dll","winnsi.dll","nlssorting.dll","WSHTCPIP.DLL","vaultcli.dll","System.Security.ni.dll","msasn1.dll","rpcrt4.dll","rasadhlp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winhttp.dll","Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll","System.Windows.Forms.ni.dll","aepic.dll","Windows.StateRepositoryPS.dll","kernel.appcore.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","api-ms-win-core-xstate-l2-1-0.dll","Wldap32.dll","api-ms-win-core-file-l2-1-0.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll","Microsoft.VisualBasic.ni.dll","System.Management.ni.dll","dpapi.dll","profapi.dll","atl.dll","rpcss.dll","kernel32.dll","api-ms-win-crt-locale-l1-1-0.dll","System.Data.dll","wow64win.dll","coml2.dll","mscorlib.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll","webio.dll","api-ms-win-crt-math-l1-1-0.dll","Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll","Microsoft.CSharp.ni.dll","System.Drawing.dll","Microsoft.BitLocker.Structures.dll","Microsoft.Management.Infrastructure.Native.ni.dll","api-ms-win-core-timezone-l1-1-0.dll","secur32.dll","api-ms-win-core-file-l1-2-0.dll","cryptbase.dll","api-ms-win-crt-time-l1-1-0.dll","userenv.dll","WinTypes.dll","gdi32.dll","System.Management.Automation.dll","Microsoft.Management.Infrastructure.ni.dll","taskschd.dll","wbemprox.dll","dwmapi.dll","slc.dll","msvcp_win.dll","ncrypt.dll","wshqos.dll","WMINet_Utils.dll","mi.dll","wldp.dll","AppxSip.dll","System.Windows.Forms.dll","wbemcomn2.dll","miutils.dll","Microsoft.VisualBasic.dll","xmllite.dll","System.Transactions.ni.dll","dnsapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ktmw32.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.DirectoryServices.ni.dll","nsi.dll","Microsoft.PowerShell.LocalAccounts.dll","System.Management.Automation.ni.dll","System.Numerics.dll","gdi32full.dll","msIso.dll","System.Security.dll","Microsoft.AppV.AppvClientComConsumer.dll","MpOAV.dll","Microsoft.PowerShell.Security.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll","propsys.dll","user32.dll","normaliz.dll","shell32.dll","wbemcomn.dll","imagehlp.dll","wshext.dll","gpapi.dll","IPHLPAPI.DLL","version.dll","wmiutils.dll","sppc.dll","wow64.dll","Accessibility.dll","ucrtbase_clr0400.dll","ole32.dll","api-ms-win-core-processthreads-l1-1-1.dll","mscoreei.dll","api-ms-win-downlevel-version-l1-1-0.dll","usp10.dll","System.DirectoryServices.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","FWPUCLNT.DLL","fltLib.dll","fastprox.dll","DWrite.dll","msvcp140.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","api-ms-win-crt-heap-l1-1-0.dll","imm32.dll","WindowsCodecs.dll","oleaut32.dll","System.Management.dll","ntdll.dll","VxSSL32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","mscoree.dll","api-ms-win-crt-convert-l1-1-0.dll","diasymreader.dll","MpClient.dll","iertutil.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","mswsock.dll","bcrypt.dll","System.Configuration.Install.dll","sechost.dll","devobj.dll","clr.dll","msisip.dll","System.ni.dll","wininet.dll","ntdsapi.dll","ucrtbase.dll","clbcatq.dll","comctl32.dll","OpcServices.dll","combase.dll","cldapi.dll","SensApi.dll","rsaenh.dll","api-ms-win-core-localization-l1-2-0.dll","System.Configuration.ni.dll","credssp.dll","System.Xml.ni.dll","windows.storage.dll","Microsoft.PowerShell.Commands.Utility.dll","AutoItX3.PowerShell.dll","cryptnet.dll","api-ms-win-crt-environment-l1-1-0.dll","GdiPlus.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.AppV.AppVClientPowerShell.dll","ieframe.dll","clrjit.dll","setupapi.dll","System.Data.ni.dll","msvcrt.dll","System.Core.ni.dll","Microsoft.PowerShell.Commands.Management.dll","Microsoft.Management.Infrastructure.Native.dll","sspicli.dll","apphelp.dll","api-ms-win-crt-utility-l1-1-0.dll","edputil.dll","System.Numerics.ni.dll","urlmon.dll","wbemsvc.dll"],"processes":[{"command_line":"","icon":"$22","name":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe","normalized_path":"C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe","pid":5576,"ppid":0,"sha256":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","uid":"00000000-00005576"},{"command_line":"Add-MpPreference -ExclusionPath \"C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005576","pid":5640,"ppid":5576,"sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","uid":"00000000-00005640"},{"command_line":"Add-MpPreference -ExclusionPath \"%APPDATA%\\oNWwWxxYw.exe\"","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005576","pid":5932,"ppid":5576,"sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","uid":"00000000-00005932"},{"command_line":"/Create /TN \"Updates\\oNWwWxxYw\" /XML \"%TEMP%\\tmpB78B.tmp\"","name":"schtasks.exe","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00005576","pid":5960,"ppid":5576,"sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","uid":"00000000-00005960"},{"command_line":"","name":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe","normalized_path":"C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe","parent_uid":"00000000-00005576","pid":5924,"ppid":5576,"sha256":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","uid":"00000000-00005924"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]}],"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-08-19T05:23:37+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"6a853dd83eb3dd27ef028a26","indicators_count":{"informative":201,"malicious":19,"suspicious":53},"is_in_unified_schema":true,"malware_family":"MSIL.Noon","state":"SUCCESS","submit_name":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","tags":["Multi-Process","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2024-07-05T11:46:38+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"6687dd1eb57ea2f40c055331","indicators_count":{"informative":164,"malicious":15,"suspicious":49},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"rStatementofAccountasat30MAY-JUN2024.exe","tags":["Multi-Process","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":1,"extracted_files_count":8,"files_deleted_count":0,"files_written_count":19,"http_requests_count":0,"imported_dlls_count":213,"injected_processes_count":0,"mutex_created_count":17,"process_count":5,"registry_keys_created_count":26,"registry_keys_deleted_count":4,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":30,"script_calls_count":0,"spawned_processes_count":5}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"SUCCESS","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"FormBook.Generic"},{"sources":[{"report_id":"","report_type":"qsp"}],"value":"OriginLogger"},{"sources":[{"report_id":"","report_type":"qsp"}],"value":"AgentTesla"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.TrojanX-gen","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan[Spy]/MSIL.Noon","verdict":"malicious"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/W32.MalwareX","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Variant.FormBook.877","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Packed.Trojanx-10032867-0","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Gen:Variant.FormBook.877 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"MSIL/Spy.AgentTesla.F trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TrojanSpy/MSIL.AgentTesla.mq","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan ( 005d5f371 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Malware","verdict":"malicious"},"sentinelone":{"data_source":"MetaDefender","name":"SentinelOne","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"high_entropy","verdict":"malicious"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Troj/Krypt-ABH","verdict":"malicious"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan-JAJW!CBEB517B5391","verdict":"malicious"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/MSIL_Kryptik.BYC.gen!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.MSIL_Heur.A","verdict":"malicious"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.AgentTesla.Win32.10983","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"details_count":2,"name":"Persistence","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"details_count":4,"name":"Fingerprint","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"}],"details_count":4,"name":"Spyware","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"details":[{"detail":"Reads FTP client related files"},{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Identified FTP credentials location strings"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"details_count":5,"name":"Stealer/Phishing","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]}],"intel_graph":{"chains":[{"edges":[],"id":"1542749712920331502","root":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"reasons":["Adds exclusion path for Windows Defender","Creates scheduled task using schtasks.exe","Detected malicious dynamic behaviour","Detected malware C2 configuration","Detected relationship with a Threat OriginLogger","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat AgentTesla","confirmed relationship with a Threat OriginLogger"],"verdict":"malicious","verdict_source":"indicator database"}},{"edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161"}],"id":"1542749693809032361","root":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"Threat:d1c3ca8494f7062ac04e2ecaa9ae8b991dcf3751c856d2867c4249d88ecd4d62"}],"id":"1542749693804838056","root":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"edges":[{"edge_kind":"memory","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:6fcd1172f56895ef045625a179a757f007c13d8856e73f51d5ca587ad3576361"},{"edge_kind":"is_threat","from_key":"File:6fcd1172f56895ef045625a179a757f007c13d8856e73f51d5ca587ad3576361","to_key":"Threat:d1c3ca8494f7062ac04e2ecaa9ae8b991dcf3751c856d2867c4249d88ecd4d62"}],"id":"1542749710180328378","root":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"reasons":["Malware presence detected","confirmed relationship with a Threat"],"verdict":"malicious","verdict_source":"dynamic and static analysis"}},{"edges":[{"edge_kind":"memory","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:6fcd1172f56895ef045625a179a757f007c13d8856e73f51d5ca587ad3576361"},{"edge_kind":"contains_c2_config","from_key":"File:6fcd1172f56895ef045625a179a757f007c13d8856e73f51d5ca587ad3576361","to_key":"Url:613786d50df1ab5f582ebacb25e4691b9fd68e1820412b5e6764a62a4eefe2a0"}],"id":"1542749697561231956","root":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"reasons":["Malware presence detected"],"verdict":"malicious","verdict_source":"dynamic and static analysis"}},{"edges":[{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:d1bcba313caf5d5418a2fa96aa679914581002246c4309d76db55e66ebab1958"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:8013f6cd1a83fa23f56b9e4a135621af9feeb6ddbfd794ed0b7e7cb6b7ddd665"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:4decc71c4ab9eec877623b11bd8807dd78f1cb61b405508a3e9eab176168e4a3"},{"edge_kind":"extracted","from_key":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"}],"id":"sandbox_files","root":"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"verdict":"unknown","verdict_source":"sandbox"}}],"map":{"File:0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d":{"type":"File","value":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029":{"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec","type":"File","value":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","verdict":{"reasons":["Adds exclusion path for Windows Defender","Creates scheduled task using schtasks.exe","Detected malicious dynamic behaviour","Detected malware C2 configuration","Detected relationship with a Threat OriginLogger","Dynamic analysis produced likely malicious output file","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat AgentTesla","confirmed relationship with a Threat OriginLogger"],"verdict":"malicious","verdict_source":"indicator database"}},"File:4decc71c4ab9eec877623b11bd8807dd78f1cb61b405508a3e9eab176168e4a3":{"type":"File","value":"4decc71c4ab9eec877623b11bd8807dd78f1cb61b405508a3e9eab176168e4a3"},"File:6fcd1172f56895ef045625a179a757f007c13d8856e73f51d5ca587ad3576361":{"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec","type":"File","value":"6fcd1172f56895ef045625a179a757f007c13d8856e73f51d5ca587ad3576361","verdict":{"reasons":["Detected malware C2 configuration","Detected relationship with a Threat OriginLogger","confirmed relationship with a Threat"],"verdict":"malicious","verdict_source":"dynamic and static analysis"}},"File:8013f6cd1a83fa23f56b9e4a135621af9feeb6ddbfd794ed0b7e7cb6b7ddd665":{"type":"File","value":"8013f6cd1a83fa23f56b9e4a135621af9feeb6ddbfd794ed0b7e7cb6b7ddd665"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:d1bcba313caf5d5418a2fa96aa679914581002246c4309d76db55e66ebab1958":{"type":"File","value":"d1bcba313caf5d5418a2fa96aa679914581002246c4309d76db55e66ebab1958"},"File:e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982":{"type":"File","value":"e44d9a2ed9c1a63c162a13d3e1906145766bb048baa3c87c17f15ddf00ce4982"},"Threat:301a5a9d2466d9ec0b1809fc94aee434ce09967d0c76ba05f0aa5960b1b34161":{"type":"Threat","value":"AgentTesla","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:d1c3ca8494f7062ac04e2ecaa9ae8b991dcf3751c856d2867c4249d88ecd4d62":{"type":"Threat","value":"OriginLogger","verdict":{"reasons":["Detected relationship with a Threat OriginLogger","confirmed relationship with a Threat"],"verdict":"malicious","verdict_source":"dynamic and static analysis"}},"Url:613786d50df1ab5f582ebacb25e4691b9fd68e1820412b5e6764a62a4eefe2a0":{"type":"Url","value":"smtp://mail.commtechtrading.com:587","verdict":{"reasons":["Detected malware C2 configuration"],"verdict":"malicious","verdict_source":"dynamic and static analysis"}}}},"mitre_attacks":[{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Discovery","technique":"Domain Groups"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"Device Driver Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials in Registry"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Creates file in AppData directory"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1021.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/005","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"VNC"},{"attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Mutual Exclusion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains ability to perform email related activity (Dotnet)"},{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Mail Protocols"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform sql operations (Dotnet)"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials In Files"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"},{"type":"suspicious","value":"Reads FTP client related files"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed from task XML file"},{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"suspicious","value":"Tries to access a Windows Vault/Credential locations"},{"type":"informative","value":"Found string related to Windows Vault/Credentials location"},{"type":"informative","value":"Able to access Windows Vault"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Windows Credential Manager"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive Collected Data"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Web Browsers"},{"attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Impair Defenses"},{"attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Email Accounts"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - Customized RC4 encryption for MSIL"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerade Task or Service"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Services"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Scheduled Task/Job"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"},{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Persistence","technique":"Transport Agent"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Storage Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Checks"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"},{"type":"informative","value":"Found strings related to file managers"}],"sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes PowerShell with command line"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Execution","technique":"PowerShell"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"suspicious","value":"Tries to steal VPN information (file access)"},{"type":"informative","value":"May execute SQL queries"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"},{"type":"suspicious","value":"Found Pidgin accounts related filepath string"},{"type":"malicious","value":"Tries to steal FTP credentials from registry"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes likely due to injection"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to gather system information (.NET)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Direct Volume Access"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"}],"rule_matches":{},"sandbox_signatures":[{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","id":"registry-31","level":"malicious","mitre_attack_id":"T1012","name":"Reads FTP client related registry keys","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\oNWwWxxYw\" /XML \"%TEMP%\\\\tmpB78B.tmp\"\" (UID: 00000000-00005960)","id":"target-414","level":"malicious","mitre_attack_id":"T1053.005","name":"Schedules a task to be executed from task XML file","origin":"Monitored Target","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-356","level":"informative","mitre_attack_id":"T1140","name":"Able to decrypt/decode data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileName\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\onwwwxxyw.exe\"\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmpb78b.tmp\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\welcqnln.3bd.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\httrxwjg.ssl.psm1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\vmgffarz.3aa.ps1\"\n \"powershell.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\fnv4mnsi.iap.psm1\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\"\" (UID: 00000000-00005640)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\oNWwWxxYw.exe\"\" (UID: 00000000-00005932)","id":"target-486","level":"informative","mitre_attack_id":"T1059.001","name":"Executes PowerShell with command line","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"System Security","description":"$23","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"oNWwWxxYw.exe\" - Location: [%APPDATA%\\oNWwWxxYw.exe]- [targetUID: 00000000-00005576]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005932]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005932]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005932]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008756)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008916)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008300)","id":"api-179","level":"informative","mitre_attack_id":"T1562.001","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","origin":"API Call","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"Win32API|Device Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006652.00000001.100321.034D4000.00000004.mdmp, 00000000-00006652.00000002.102239.034D4000.00000004.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$24","id":"registry-37","level":"malicious","mitre_attack_id":"T1114","name":"Tries to steal Mail credentials from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$25","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference string \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\2a005539d78a0c685832affb3bfbfba01d\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005576-00000C47-28940762362\"), Found reference string \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\oNWw\" (Indicator: \"add-mppreference\"; Source: \"00000000-00005576-00000C47-33661927370\")\n Found reference string \"Add-MpPreference -ExclusionPath \"C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\"\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\")\n Found reference string \"Add-MpPreference -ExclusionPath \"%APPDATA%\\oNWwWxxYw.exe\"\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\")","id":"string-980","level":"informative","mitre_attack_id":"T1562.001","name":"Able to modify Windows Defender exclusions (Powershell command string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" claims program is from Mon Aug 15 10:04:32 2044\n \"oNWwWxxYw.exe\" claims program is from Mon Aug 15 10:04:32 2044","id":"static-3","level":"suspicious","mitre_attack_id":"T1027","name":"Timestamp in PE header is very old or in the future","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\2a005539d78a0c685832affb3bf ...\" (UID: 00000000-00005640), Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\oNWwWxxYw.exe\"\" (UID: 00000000-00005932), Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\oNWwWxxYw\" /XML \"%TEMP%\\\\tmpB78B.tmp\"\" (UID: 00000000-00005960), Spawned process \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (UID: 00000000-00005924)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00005576-00000C2C-165899137\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005576-00000C2C-165899220\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005640-00000C2C-170617372\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00005640-00000C2C-170617440\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008756.00000000.97935.02FD0000.00000004.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"where email ='\" (Indicator: \"where \"; Source: \"00000000-00005576.00000000.73833.011F2000.00000020.mdmp\")\n Found string \"where email ='\" (Indicator: \"where \"; Source: \"00000000-00005924.00000000.74961.011F2000.00000020.mdmp\")","id":"string-484","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve files based on search patterns","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005576)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005576)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005576)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$27","id":"string-927","level":"informative","mitre_attack_id":"T1027","name":"Able to utilize the Windows bcrypt cryptographic API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 5924)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"powershell.exe\" queried SystemProcessInformation at 00000000-00005640-00000105-4036026 [PID: 5640]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005640-00000105-4372063 [PID: 5640]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005640-00000105-8311474 [PID: 5640]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005932-00000105-3960116 [PID: 5932]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005932-00000105-4767752 [PID: 5932]\n \"powershell.exe\" queried SystemProcessInformation at 00000000-00005932-00000105-7348654 [PID: 5932]\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" queried SystemProcessInformation at 00000000-00005924-00000105-6952475 [PID: 5924]\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" queried SystemProcessInformation at 00000000-00005924-00000105-6955306 [PID: 5924]","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".purple\\accounts.xml\" (Indicator: \"purple\\accounts.xml\") in Source: 00000000-00006652.00000001.100321.00400000.00000040.mdmp","id":"string-99","level":"suspicious","mitre_attack_id":"T1005","name":"Found Pidgin accounts related filepath string","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed function \"ResourceManager.GetObject\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed function \"ResourceManager.GetObject\" in \"oNWwWxxYw.exe\"","id":"static-112","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to load content from resource","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"The sample is known malware – Agent Tesla","id":"summary-5003","level":"malicious","name":"Known malware detected","origin":"Indicator Combinations","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"17/26 Antivirus vendors marked spawned process \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (PID: 5924) as malicious (classified as \"MSIL.Noon\" with 65% detection rate)","id":"target-58","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis spawned a process that was identified as malicious","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-486","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to encrypt/decrypt data using TripleDES","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" writes to a file \"%APPDATA%\\oNWwWxxYw.exe\"","id":"api-322","level":"informative","mitre_attack_id":"T1083","name":"Creates file in AppData directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005576)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005576)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005640)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005932)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$28","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" trying to access a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Credentials\\DFBE70A7E5CC19A398EBF1B96859CE5D\"\n \"rStatementofAccountasat30MAY-JUN2024.exe\" trying to access a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Credentials\\466BB687837BC5F9274E7EF69021FED2\"","id":"api-166","level":"suspicious","mitre_attack_id":"T1555.004","name":"Tries to access a Windows Vault/Credential locations","origin":"API Call","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$29","id":"api-131","level":"suspicious","mitre_attack_id":"T1114","name":"Tries to access mail clients information (file access)","origin":"API Call","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"oNWwWxxYw.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"tmpB78B.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmpB78B.tmp]","id":"binary-39","level":"informative","mitre_attack_id":"T1105","name":"Drops XML files","origin":"Binary File","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2a","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005576)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00006652.00000000.98400.033F0000.00000004.mdmp\n 00000000-00006652.00000001.100321.033F0000.00000004.mdmp\n 00000000-00006652.00000002.102239.033F0000.00000004.mdmp","id":"string-327","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve operating system version","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005640)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005932)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00005924)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpB78B.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\welcqnln.3bd.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\httrxwjg.ssl.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vmgffarz.3aa.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fnv4mnsi.iap.psm1\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005924.00000000.74961.002E0000.00000004.mdmp, 00000000-00005924.00000001.76887.002E0000.00000004.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp, 00000000-00005924.00000002.78810.002E0000.00000004.mdmp\")","id":"string-108","level":"informative","mitre_attack_id":"T1486","name":"Contains ability to perform encryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"tmpB78B.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmpB78B.tmp]","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"External Systems","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"External Systems","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","id":"mlmodel-16","level":"malicious","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","origin":"Static Analysis","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"Pattern Matching","description":"YARA signature for encryption algorithm process \"00000000-00005924\"","id":"yara-208","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match – Encryption algorithm","origin":"YARA Signature","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"string-5000","level":"informative","mitre_attack_id":"T1106","name":"Contains native function calls (syscalls strings)","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"Cryptographic Related","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2c","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature Malware.Agent Tesla matched on process \"00000000-00005924\"","id":"yara-4","level":"malicious","name":"YARA signature match - Agent Tesla","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\PSHost.134315906597700563.5640.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134315906614860593.5932.DefaultAppDomain.powershell","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$2d","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005576-00000C2C-158995196\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005576-00000C2C-158995907\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005576-00000C2C-165604248\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005576-00000C2C-165604330\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"oNWwWxxYw.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" read 40960 bytes from file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","id":"api-44","level":"suspicious","mitre_attack_id":"T1119","name":"Reads FTP client related files","origin":"API Call","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-513","level":"informative","mitre_attack_id":"T1057","name":"References to WMI query strings used for process discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\", \"16.0.0.0\", \"1.0.0.0\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\2a005539d78a0c685832affb3bfbfba01d\" - (UID: 00000000-00005576), \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\oNWw\" - (UID: 00000000-00005576)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\oNWwWxxYw\" /XML \"%TEMP%\\tmpB78B.tmp\"\" - (UID: 00000000-00005576)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CreateProcessA\" with parameter \"C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" - (UID: 00000000-00005576)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"WinSCP\" (Indicator: \"winscp\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"ARE\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"OFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions\" (Indicator: \"winscp\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-724","level":"informative","mitre_attack_id":"T1048.002","name":"Contains references to SFTP or FTPS file transfer","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$2e","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","id":"registry-179","level":"informative","mitre_attack_id":"T1562.001","name":"Tries to map intranet network resources to internet zone","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":".text\n .text with unusual entropies 7.95557824966\n 7.95557824966","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F7B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F790000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"00:50:56:91:3B:A9\" (Indicator: \"00:50:56\")","id":"string-2","level":"suspicious","mitre_attack_id":"T1518.001","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\"\" (UID: 00000000-00005640)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\oNWwWxxYw.exe\"\" (UID: 00000000-00005932)","id":"target-236","level":"informative","mitre_attack_id":"T1562","name":"Uses powershell with a add-mppreference commandline param","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" connecting to \"\\ThemeApiPort\"\n \"powershell.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","mitre_attack_id":"T1559","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2f","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00005576)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$30","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Process \"powershell.exe\" (UID: 00000000-00005640) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"powershell.exe\" (UID: 00000000-00005640) was launched with modified environment variables: \"Path, NUMBER_OF_PROCESSORS\"\n Process \"schtasks.exe\" (UID: 00000000-00005960) was launched with modified environment variables: \"Path\"","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$31","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63810000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63810000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp\n \":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00005576.00000001.74663.00340000.00000004.mdmp","id":"string-265","level":"informative","mitre_attack_id":"T1547.001","name":"Contains reference to Windows Startup folder","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp\")","id":"string-618","level":"informative","mitre_attack_id":"T1505.002","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005576.00000000.73833.00340000.00000004.mdmp, 00000000-00005576.00000001.74663.00340000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005924.00000000.74961.002E0000.00000004.mdmp, 00000000-00005924.00000001.76887.002E0000.00000004.mdmp, 00000000-00005924.00000002.78810.002E0000.00000004.mdmp\")","id":"string-493","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to crypto DLLs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$33","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"17/26 Antivirus vendors marked dropped file \"oNWwWxxYw.exe\" as malicious (classified as \"MSIL.Noon\" with 65% detection rate)","id":"binary-11","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis extracted a file that was identified as malicious","origin":"Binary File","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"oNWwWxxYw.exe\"","id":"static-135","level":"informative","mitre_attack_id":"T1027.002","name":"Dotnet file contains function to dynamically call methods at runtime","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008916-00000C15-551543462\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008300-00000C15-551522264","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NORDVPN\"\n \"rStatementofAccountasat30MAY-JUN2024.exe\" trying to open a file \"%LOCALAPPDATA%\\NORDVPN\"","id":"api-98","level":"suspicious","mitre_attack_id":"T1005","name":"Tries to steal VPN information (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetProcessById\" (Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-931","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve running process details (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-615","level":"informative","mitre_attack_id":"T1620","name":"Can load assembly that contains the code that is currently executing (Dotnet)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetObject\"; Source: \"sample.bin\")","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"select * from users where email='\" (Source: 6000005-forgot~btnsubmit_Click, Indicator: \"select * from users where email='\")\n \"select * from users where username='\" (Source: 6000024-Login~submission, Indicator: \"select * from users where username='\")\n \"SELECT * FROM Users WHERE email = '\" (Source: 6000043-Register~txtemail_TextChanged, Indicator: \"select * from users where email = '\")\n \"SELECT * FROM Users WHERE username = '\" (Source: 6000044-Register~txtusername_TextChanged, Indicator: \"select * from users where username = '\")\n \"Insert into users(email, username, password) values( '\" (Source: 6000049-Register~submission, Indicator: \"insert into users(email, username, password) values( '\")\n \"SELECT * FROM Win32_Processor\" (Source: 00005924.00001724.17601745.00402000.wprm, Indicator: \"select * from win32_processor\")","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.94954","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76E10000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76E10000","id":"module-17","level":"informative","mitre_attack_id":"T1069.002","name":"Loads Windows LDAP client module","origin":"Loaded Module","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Network Related","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005576)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005640)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005932)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005924)","id":"api-219","level":"informative","mitre_attack_id":"T1021","name":"Calls an API typically used to register an interface (RPC)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Making HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$34","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$35","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"5202f98\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"powershell.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"50b2638\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","id":"api-190","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to send the specified request to the HTTP server","origin":"API Call","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$36","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" was detected as \".NET\" and name: \"Library\"\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"oNWwWxxYw.exe\" was detected as \".NET\" and name: \"Library\"\n \"oNWwWxxYw.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" has an executable section named \".text\"\n \"oNWwWxxYw.exe\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Exploit/Shellcode","description":"Wrote 1243 instructions to a remote process\n Wrote 297 instructions to a remote process","id":"stream-38","level":"malicious","mitre_attack_id":"T1055","name":"Writes shellcode to a remote process","origin":"Hybrid Analysis Technology","relevance":8,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed namespace \"System.Net.Mail\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed namespace \"System.Net\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed namespace \"System.Net.Mail\" in \"oNWwWxxYw.exe\"","id":"static-110","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to provide interface for network protocols (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for Custom RC4 technique process \"00000000-00005576\"","id":"yara-168","level":"suspicious","mitre_attack_id":"T1027","name":"YARA signature match - Customized RC4 encryption for MSIL","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" called \"LoadResource with parameter {'hModule': '125173761', 'hResInfo': '125175008'}\" (UID: 00000000-00008756)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"LoadResource with parameter {'hModule': '125173761', 'hResInfo': '125175040'}\" (UID: 00000000-00008756)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"LoadResource with parameter {'hModule': '125173761', 'hResInfo': '125175056'}\" (UID: 00000000-00008756)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"LoadResource with parameter {'hModule': '125173761', 'hResInfo': '125175024'}\" (UID: 00000000-00008756)","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$37","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"file/memory contains long string with (Indicator: \"LogonTrigger\"; File: \"tmp5F85.tmp\")","id":"string-32","level":"malicious","mitre_attack_id":"T1053","name":"Found an indicator for a scheduled task trigger","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Spawned process \"rStatementofAccountasat30MAY-JUN2024.exe\" (UID: 00000000-00008756)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\rStatementofAccountasat30MAY-JUN2024.exe\"\" (UID: 00000000-00008916)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\oNWwWxxYw.exe\"\" (UID: 00000000-00008300)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\oNWwWxxYw\" /XML \"%TEMP%\\\\tmp5F85.tmp\"\" (UID: 00000000-00006864)\n Spawned process \"rStatementofAccountasat30MAY-JUN2024.exe\" (UID: 00000000-00006652)","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$38","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029 has big resource with name: \"gut\" size: \"76288\" and abnormal entropy:\"7.99773958716434\"\n oNWwWxxYw.exe has big resource with name: \"gut\" size: \"76288\" and abnormal entropy:\"7.99773958716434\"","id":"static-129","level":"informative","mitre_attack_id":"T1027","name":"Dotnet file resource with suspicious entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$39","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005576.00000001.74663.00340000.00000004.mdmp\")","id":"string-987","level":"informative","mitre_attack_id":"T1069.002","name":"References Windows LDAP client module","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Type: \"FileHandle\")","id":"handle-0","level":"suspicious","mitre_attack_id":"T1005","name":"Accesses potentially sensitive information from local browsers","origin":"Touched Handle","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"System Security","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00005932-00000C2C-184754174\")","id":"string-10073","level":"informative","mitre_attack_id":"T1489","name":"Able to change the configuration parameters of a service","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"SELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n \"ELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-55","level":"suspicious","mitre_attack_id":"T1047","name":"Found a reference to a WMI query string known to be used for VM detection","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-91","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to hook/unhook windows functions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3a","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Network Related","description":"$3b","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"External Systems","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","id":"avtest-5","level":"malicious","mitre_attack_id":"T1204.002","name":"Sample was identified as malicious by a trusted antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00008756.00000000.97935.09580000.00000004.mdmp\")","id":"string-615","level":"informative","mitre_attack_id":"T1620","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" tries to directly access volume data \"C:\"","id":"api-306","level":"informative","mitre_attack_id":"T1006","name":"Attempts to read volume data via DOS device path","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found string \"AttachmentCollection\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found string \"get_Attachments\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found string \"Attachment\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-938","level":"informative","mitre_attack_id":"T1505.002","name":"Able to establish persistence using Exchange transport agent (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","id":"api-173","level":"informative","mitre_attack_id":"T1083","name":"Tries to access Powershell profile file","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Read system defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpB78B.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\welcqnln.3bd.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\httrxwjg.ssl.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vmgffarz.3aa.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fnv4mnsi.iap.psm1\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"VaultGetItem_WIN8\" (Indicator: \"VaultGetItem_WIN8\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"VaultGetItem_WIN8\" (Indicator: \"VaultGetItem\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"VaultGetItem\" (Indicator: \"VaultGetItem\"; File: \"00005924.00001724.17601745.00402000.wprm\")","id":"string-627","level":"informative","mitre_attack_id":"T1555.004","name":"Able to access Windows Vault","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\rStatementofAccountasat30MAY-JUN2024.exe.log\"\n \"rStatementofAccountasat30MAY-JUN2024.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\rStatementofAccountasat30MAY-JUN2024.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","id":"api-159","level":"informative","mitre_attack_id":"T1074.001","name":"Writes log files","origin":"API Call","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Processor\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-507","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used for information discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" set thread context in remote process \"C:\\rStatementofAccountasat30MAY-JUN2024.exe\" (PID: 19fc)","id":"api-14","level":"malicious","mitre_attack_id":"T1055.012","name":"Sets thread context in a remote process (often injection or process hollowing)","origin":"API Call","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"0d000e002203c86b@ADVAPI32.dll\"\n \"0d000e00fe02c86b@ADVAPI32.dll\"\n \"0b000c00cc02c86b@ADVAPI32.dll\"\n \"10001100da02c86b@ADVAPI32.dll\"\n \"1500160020738e6a@ADVAPI32.dll\"\n \"0e000f00e4738e6a@ADVAPI32.dll\"\n \"0e000f0050748e6a@ADVAPI32.dll\"\n \"11001200d47d8e6a@ADVAPI32.dll\"\n \"110012007c7e8e6a@ADVAPI32.dll\"\n \"12001300cc7e8e6a@ADVAPI32.dll\"\n \"12001300387f8e6a@ADVAPI32.dll\"\n \"14001500e4b78e6a@ADVAPI32.dll\"\n \"1400150000b88e6a@ADVAPI32.dll\"\n \"140015001cb88e6a@ADVAPI32.dll\"\n \"1700180038b88e6a@ADVAPI32.dll\"\n \"0d000e0054b88e6a@ADVAPI32.dll\"\n \"1100120064b88e6a@ADVAPI32.dll\"\n \"110012007cb88e6a@ADVAPI32.dll\"\n \"0f001000ecb98e6a@ADVAPI32.dll\"\n \"1400150038ba8e6a@ADVAPI32.dll\"\n \"1400150054ba8e6a@ADVAPI32.dll\"\n \"0c000d00a8ba8e6a@ADVAPI32.dll\"\n \"0c000d00b8ba8e6a@ADVAPI32.dll\"\n \"0e000f00c8ba8e6a@ADVAPI32.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005576-00000C2C-162162262\")","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"oNWwWxxYw.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\oNWwWxxYw.exe]- [targetUID: 00000000-00005576]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005932]\n \"tmpB78B.tmp\" has type \"XML 1.0 document ASCII text\"- Location: [%TEMP%\\tmpB78B.tmp]- [targetUID: 00000000-00005576]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005932]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005932]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$3c","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"BCryptSetProperty\" (Indicator: \"BCryptSetProperty\"; File: \"00005924.00001724.17601745.00402000.wprm\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"oNWwWxxYw.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00006652.00000000.98400.04F70000.00000004.mdmp]","id":"string-155","level":"informative","mitre_attack_id":"T1047","name":"Found WMI keywords in script (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1090.001","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"3e3a80\"\n \"Count\": \"1\"}","id":"api-255","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user names for specified SIDs","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\2a005539d78a0c685832affb3bf ...\" (UID: 00000000-00005640), Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\oNWwWxxYw.exe\"\" (UID: 00000000-00005932), Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\oNWwWxxYw\" /XML \"%TEMP%\\\\tmpB78B.tmp\"\" (UID: 00000000-00005960), Spawned process \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (UID: 00000000-00005924)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005576.00000000.73833.012A0000.00000002.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00005576.00000001.74663.00340000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00005576.00000001.74663.00340000.00000004.mdmp\")","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3d","id":"api-96","level":"malicious","mitre_attack_id":"T1005","name":"Tries to steal browser sensitive information (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00005924.00000000.74961.002E0000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00005924.00000001.76887.002E0000.00000004.mdmp\")\n Found URL \"http://user.configfile:.configfile://datadirectoryfile:http:\\\\?\\globalroot\" - Source: \"00000000-00005924.00000001.76887.01EA0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2000/09/xmldsig\" - Source: \"00000000-00005924.00000001.76887.01EA0000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00005924.00000002.78810.002E0000.00000004.mdmp\")","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005924.00000000.74961.002E0000.00000004.mdmp, 00000000-00005924.00000001.76887.002E0000.00000004.mdmp, 00000000-00005924.00000001.76887.01EA0000.00000004.mdmp, 00000000-00005924.00000002.78810.002E0000.00000004.mdmp\")","id":"string-920","level":"informative","mitre_attack_id":"T1486","name":"Able to access crypto-related API (String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" has section name .text with entropy \"7.955578249657794\"\n \"oNWwWxxYw.exe\" has section name .text with entropy \"7.955578249657794\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"Section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","id":"api-281","level":"malicious","mitre_attack_id":"T1555.003","name":"Attempts to obtain browser login credentials (file access)","origin":"API Call","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3e","id":"api-229","level":"informative","mitre_attack_id":"T1027","name":"Calls an API typically used to convert data from string to binary","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"oNWwWxxYw.exe\"","id":"static-161","level":"informative","mitre_attack_id":"T1564.003","name":"Able to execute applications in hidden mode (.NET)","origin":"Static Parser","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3f","id":"string-136","level":"informative","mitre_attack_id":"T1555","name":"Strings related to file managers detected","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \".ctor\" in \"rStatementofAccountasat30MAY-JUN2024.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \".ctor\" in \"rStatementofAccountasat30MAY-JUN2024.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"ExecuteReader\" in \"rStatementofAccountasat30MAY-JUN2024.exe\"\n Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \".ctor\" in \"oNWwWxxYw.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \".ctor\" in \"oNWwWxxYw.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"ExecuteReader\" in \"oNWwWxxYw.exe\"","id":"static-175","level":"informative","mitre_attack_id":"T1213","name":"Contains ability to perform sql operations (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73A60000","id":"module-4","level":"malicious","mitre_attack_id":"T1559.001","name":"Loads the task scheduler COM API","origin":"Loaded Module","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"sample.bin\")","id":"string-836","level":"informative","mitre_attack_id":"T1213","name":"Able to perform SQL operations","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"FTP Navigator\\Ftplist.txt\" (Indicator: \"ftp navigator\")\n \"FTP Navigator\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"pswitch\\WS_FTP\\Sites\\ws_ftp.ini\" (Indicator: \"ws_ftp\")\n \"cftp\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"Program Files (x86)\\FTP Commander\\Ftplist.txt\" (Indicator: \"ftplist.txt\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftp commander\")\n \"VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt\" (Indicator: \"ftplist.txt\")","id":"string-136","level":"informative","mitre_attack_id":"T1555","name":"Found strings related to file managers","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmpB78B.tmp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\welcqnln.3bd.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\httrxwjg.ssl.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vmgffarz.3aa.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fnv4mnsi.iap.psm1\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLastAccessTime\" (Indicator: \"GetLastAccessTime\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetLastAccessTime\" (Indicator: \"GetLastAccessTime\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Able to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed email domain:\"smtp.gmail.com\" [Source: 6000005-forgot~btnsubmit_Click]","id":"string-169","level":"informative","mitre_attack_id":"T1071.003","name":"Found mail related domain names","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"PRIVATE KEY LOCATION: \"{0}\"]\" (Indicator: \"private key\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found string \"set_UseShellExecute\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-934","level":"informative","mitre_attack_id":"T1106","name":"Able to execute applications using .NET process API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"$40","id":"api-22","level":"informative","mitre_attack_id":"T1129","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00008756)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00008756)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00008756)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00008756)","id":"api-140","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to find a resource in a module","origin":"API Call","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"buyin.mailyou@gmail.com\"\n Pattern match: \"uyin.mailyou@gmail.com\"\n Pattern match: \"iajul.haq@commtechtrading.com\"","id":"string-63","level":"informative","mitre_attack_id":"T1114","name":"Found E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"$41","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"External Systems","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","id":"mlmodel-12","level":"malicious","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","origin":"Static Analysis","sources":[{"report_id":"","report_type":"qsp"}]},{"category":"General","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","id":"registry-100","level":"malicious","mitre_attack_id":"T1005","name":"Tries to steal FTP credentials from registry","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"details too long to display","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Able to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"System Security","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75090000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75090000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74C50000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$42","id":"string-129","level":"informative","mitre_attack_id":"T1114","name":"Found mail information locations related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005640-00000C2C-184541468\")","id":"string-739","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve geographical location information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"External Systems","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-998","level":"informative","mitre_attack_id":"T1680","name":"Able to enumerate disk drives (API string)","origin":"File/Memory","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005576)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005640)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005932)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005960)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005924)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005576-00000C2C-161280572\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005640-00000C2C-172532321\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"QueryDosDevice\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-227","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about MS-DOS device names (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005576-00000C2C-161280572\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005640-00000C2C-172532321\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve logical drive information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor byte ptr [eax+eax]\n al in Stream UID: 00000000-00005924-14217-58-00415638\n Assembly shows XOR instruction xor al\n 00h in Stream UID: 00000000-00005924-14217-58-00415638\n Assembly shows XOR instruction xor eax\n 5F000001h in Stream UID: 00000000-00005924-14217-58-00415638\n Assembly shows XOR instruction xor dword ptr [eax]\n eax in Stream UID: 00000000-00005924-14217-58-00415638","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\oNWwWxxYw\" /XML \"%TEMP%\\\\tmpB78B.tmp\"\" (UID: 00000000-00005960)","id":"target-13","level":"malicious","mitre_attack_id":"T1053.005","name":"Schedules a task to be executed at a specific time and date","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00008756.00000000.97935.02FD0000.00000004.mdmp","id":"string-231","level":"informative","mitre_attack_id":"T1562.001","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006652.00000000.98400.04F70000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00006652.00000000.98400.04F70000.00000004.mdmp\")","id":"string-352","level":"informative","mitre_attack_id":"T1573.002","name":"Contains ability to perform encryption/decryption using RSA algorithm","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows filepaths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008916)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008300)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"GetComputerNameW\" (UID: 00000000-00006652)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"RegQueryValueEx\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyEx\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$44","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","id":"registry-174","level":"informative","mitre_attack_id":"T1652","name":"Tries to retrieve device driver information","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008916)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00008916)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008300)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00008300)","id":"api-110","level":"suspicious","mitre_attack_id":"T1082","name":"Calls an API typically used to find and list the Windows drive types","origin":"API Call","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$45","id":"api-45","level":"suspicious","mitre_attack_id":"T1005","name":"Checks on FTP client related files","origin":"API Call","relevance":8,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for high entropy images embedded in resource file \"sample.bin\"\n YARA signature for high entropy images embedded in resource file \"oNWwWxxYw.exe.3073501574\"","id":"yara-214","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match – high entropy image embedded in .NET resource","origin":"YARA Signature","relevance":7,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegQueryValueEx\" in \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\"\n Found registry query API: \"RegOpenKeyEx\" in \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \".ctor\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \".ctor\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"ExecuteReader\" in \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\"\n Observed namespace \"System.Data.SqlClient.SqlConnection\" and TypeReference \".ctor\" in \"oNWwWxxYw.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \".ctor\" in \"oNWwWxxYw.exe\"\n Observed namespace \"System.Data.SqlClient.SqlCommand\" and TypeReference \"ExecuteReader\" in \"oNWwWxxYw.exe\"","id":"static-175","level":"informative","mitre_attack_id":"T1213","name":"Able to perform SQL operations (Dotnet)","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"$46","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"oNWwWxxYw.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%APPDATA%\\oNWwWxxYw.exe]- [targetUID: 00000000-00005576]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Process 2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","id":"mutant-0","level":"informative","mitre_attack_id":"T1480.002","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"$47","id":"string-30","level":"suspicious","mitre_attack_id":"T1047","name":"Contains references to WMI/WMIC","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string \"GZipStream\" (Source: \"00000000-00005576.00000001.74663.00570000.00000004.mdmp\")","id":"string-935","level":"informative","mitre_attack_id":"T1560.002","name":"Able to compress/decompress content at runtime","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$48","id":"api-39","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":8,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","id":"registry-74","level":"malicious","mitre_attack_id":"T1552.002","name":"Tries to steal Putty/Winscp sessions from registry","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134315906597700563.5640.DefaultAppDomain.powershell\" - (UID: 00000000-00005640)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134315906614860593.5932.DefaultAppDomain.powershell\" - (UID: 00000000-00005932)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"IsWow64Process\" with parameter \"5576\" - (UID: 00000000-00005576)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5640\" - (UID: 00000000-00005640)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"5932\" - (UID: 00000000-00005932)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"5960\" - (UID: 00000000-00005960)\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"IsWow64Process\" with parameter \"5924\" - (UID: 00000000-00005924)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76D60000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76D60000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76D60000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \"9;.ms\", Heuristic match: \"ha.hm\", Heuristic match: \",<}.al\", Heuristic match: \"gq.be\"","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"CreateFileMapping\" (Indicator: \"CreateFile\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005640)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005932)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$49","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"select * from users where email='\" (Indicator: \"select * from \"; File: \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\")\n Found string \"select * from users where username='\" (Indicator: \"select * from \"; File: \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\")\n Found string \"SELECT * FROM Users WHERE email = '\" (Indicator: \"select * from \"; File: \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\")\n Found string \"SELECT * FROM Users WHERE username = '\" (Indicator: \"select * from \"; File: \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\")\n Found string \"SELECT * FROM Win32_Processor\" (Indicator: \"select * from \"; File: \"00005924.00001724.17601745.00402000.wprm\")","id":"string-433","level":"informative","mitre_attack_id":"T1047","name":"Contains ability to execute a WMI query","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4a","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string - -zA-Z]([-\\.\\w]*[0-9a-zA-Z])*@([0-9a-zA-Z][-\\w]*[0-9a-zA-Z]\\.)+[a-zA-Z]{2\n9})$; Source: \"00000000-00005576.00000000.73833.011F2000.00000020.mdmp\")\n Found string - ([0-9a-zA-Z]([-\\.\\w]*[0-9a-zA-Z])*@([0-9a-zA-Z][-\\w]*[0-9a-zA-Z]\\.)+[a-zA-Z]{2\n9})$; Source: \"00000000-00005576.00000000.73833.011F2000.00000020.mdmp\")\n Found string - ([0-9a-zA-Z]([-\\.\\w]*[0-9a-zA-Z])*@([0-9a-zA-Z][-\\w]*[0-9a-zA-Z]\\.)+[a-zA-Z]{2\n9})$; Source: \"00000000-00005924.00000000.74961.011F2000.00000020.mdmp\")","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"$4b","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"select * from users where email='\" (Source: 6000005-forgot~btnsubmit_Click, Indicator: \"select * from users where email='\")\n \"select * from users where username='\" (Source: 6000024-Login~submission, Indicator: \"select * from users where username='\")\n \"SELECT * FROM Users WHERE email = '\" (Source: 6000043-Register~txtemail_TextChanged, Indicator: \"select * from users where email = '\")\n \"SELECT * FROM Users WHERE username = '\" (Source: 6000044-Register~txtusername_TextChanged, Indicator: \"select * from users where username = '\")\n \"Insert into users(email, username, password) values( '\" (Source: 6000049-Register~submission, Indicator: \"insert into users(email, username, password) values( '\")","id":"string-605","level":"informative","mitre_attack_id":"T1005","name":"May execute SQL queries","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Spawned process \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (UID: 00000000-00005576)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\"\" (UID: 00000000-00005640)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\oNWwWxxYw.exe\"\" (UID: 00000000-00005932)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\oNWwWxxYw\" /XML \"%TEMP%\\\\tmpB78B.tmp\"\" (UID: 00000000-00005960)\n Spawned process \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (UID: 00000000-00005924)","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns many processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","id":"registry-106","level":"informative","mitre_attack_id":"T1082","name":"Reads system-defined device setup information from registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006652.00000000.98400.04F70000.00000004.mdmp\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-603","level":"informative","mitre_attack_id":"T1486","name":"Able to import cryptographic keys (seen in ransomware)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64470000\n \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64C20000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64C20000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005576)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$4c","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" called \"GetUserNameW\" (UID: 00000000-00008756)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008916)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008300)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" called \"GetUserNameW\" (UID: 00000000-00006652)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006652.00000001.100321.00400000.00000040.mdmp\")","id":"string-84","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to find logical drives of the machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"7943350894,8156,3025,,RtlGetNtProductType,NTDLL.\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00008756.00000000.97935.02FD0000.00000004.mdmp\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about operating system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00005924-00000C2E-28587416614\")\n \"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00005924-00000C2E-28590003774\")","id":"string-197","level":"informative","mitre_attack_id":"T1555.004","name":"Found string related to Windows Vault/Credentials location","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","id":"string-65","level":"informative","name":"Possibly uses a Windows Server utility","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"System.Windows.Forms.Control::set_TabIndex(System.Int32) at cbeb517b53913ab39c8ba111dd5a3207-6000052-Register~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at cbeb517b53913ab39c8ba111dd5a3207-6000057-Welcome~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at cbeb517b53913ab39c8ba111dd5a3207-6000016-forgot~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at cbeb517b53913ab39c8ba111dd5a3207-600002f-Login~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at cbeb517b53913ab39c8ba111dd5a3207-600001b-Home~InitializeComponent","id":"stream-85","level":"suspicious","mitre_attack_id":"T1571","name":"Contains ability to open a port and listen for incoming connection","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005640)\n \"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005932)","id":"api-223","level":"suspicious","mitre_attack_id":"T1070.006","name":"Calls an API typically used to query local/system time as file time","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"kyaes #\" (Indicator: \"aes\"; Source: \"sample.bin\")","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"oNWwWxxYw.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","id":"static-144","level":"informative","name":"PE file contains COM data directory","origin":"Static Parser","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"$4d","id":"static-160","level":"informative","mitre_attack_id":"T1071.003","name":"Contains ability to perform email related activity (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"buyin.mailyou@gmail.com\" (Indicator: \"@gmail.\"; File: \"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\")","id":"string-235","level":"informative","mitre_attack_id":"T1585.002","name":"Found email domains (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"C:\\rStatementofAccountasat30MAY-JUN2024.exe\" spawned likely due to injection","id":"target-413","level":"suspicious","mitre_attack_id":"T1055","name":"Spawned processes likely due to injection","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005576)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4e","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode base64 data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")","id":"string-217","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve user privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5202f98\"\n \"lpReserved\": \"0\"}\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"50b2638\"\n \"lpReserved\": \"0\"}","id":"api-191","level":"informative","mitre_attack_id":"T1071.001","name":"Calls an API typically used to to receive the response to a HTTP requests","origin":"API Call","relevance":2,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"txtpassword_Click\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Something went wrong! Please make sure the username and password are correct\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"txtpassword_Leave\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"txtpassword_TextChanged\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"lxpassword\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"lconfirmpassword\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"lconfirmpassword_Click\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"lpassword\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"txtpassword\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"lpassword_Click\" (Indicator: \"password\"; Source: \"sample.bin\")","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; File: \"00005924.00001724.17601745.00402000.wprm\")\n Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Able to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"indows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00005576.00000001.74663.00340000.00000004.mdmp\")\n Found string \":\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00005576.00000001.74663.00340000.00000004.mdmp\")","id":"string-940","level":"informative","mitre_attack_id":"T1021","name":"Able to modify Remote Configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"oNWwWxxYw.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"$4f","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005576-00000C47-28940762362]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\2a005539d78a0c685832affb3bfbfba01d\" [Source: 00000000-00005576-00000C47-28940762362], Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\oNWw\" [Source: 00000000-00005576-00000C47-33661927370]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00005576-00000C47-37168518156]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\oNWwWxxYw\" /XML \"%TEMP%\\tmpB78B.tmp\"\" [Source: 00000000-00005576-00000C47-37168518156]","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"get_UserName\" (Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"string-937","level":"informative","mitre_attack_id":"T1082","name":"Able to gather system information (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"$50","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found PE header \"MZ\" - Source: \"00000000-00005576.00000001.74663.00440000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005576.00000001.74663.00570000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005576.00000001.74663.00AF0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005924.00000000.74961.00400000.00000040.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CreateProcessA\" with parameter \"C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" - (UID: 00000000-00005576)","id":"api-129","level":"malicious","mitre_attack_id":"T1055","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"\"bquP.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"rStatementofAccountasat30MAY-JUN2024.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 8756)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 8916)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 8300)\n \"rStatementofAccountasat30MAY-JUN2024.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6652)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"SmtpDeliveryMethod\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SmtpClient\" (Indicator: \"smtp\"; Source: \"sample.bin\")","id":"string-499","level":"informative","mitre_attack_id":"T1071.003","name":"Contains reference to Mail transfer protocol","origin":"sample.bin","sources":[{"report_id":"","report_type":"qsp"},{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"$51","id":"yara-553","level":"suspicious","name":"Yara Signature Match - Indicators","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"}]},{"category":"General","description":"\"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe\" called \"CopyFileW\" to copy C:\\2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029.exe to new location %APPDATA%\\oNWwWxxYw.exe (UID: 00000000-00005576)","id":"api-123","level":"informative","mitre_attack_id":"T1005","name":"Calls an API typically used to copy file from one location to another","origin":"API Call","relevance":3,"sources":[{"report_id":"6a853dd83eb3dd27ef028a26","report_type":"sandbox"},{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"General","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00006652.00000000.98400.04F70000.00000004.mdmp\")","id":"string-127","level":"informative","mitre_attack_id":"T1071.001","name":"Found user-agent related strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00006652.00000000.98400.04F70000.00000004.mdmp\")","id":"string-455","level":"informative","mitre_attack_id":"T1569.002","name":"Contains reference to multiple windows system processes","origin":"File/Memory","relevance":3,"sources":[{"report_id":"6687dd1eb57ea2f40c055331","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":3,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":18,"suspicious_count":0,"total_engines":23},"mitre_attacks":{"total":94},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":243,"malicious_count":25,"suspicious_count":26,"total":294}},"summary":{"score":100,"tags":["infostealer","evasive","windows-server-utility"],"verdict":"malicious"}},"metadata":{"file_info":{"compile_timestamp":"2044-08-15T10:04:32","entropy":7.92,"file_name":"rStatementofAccountasat30MAY-JUN2024.exe","file_size":677888,"file_type":["peexe","assembly","executable"],"file_type_id":".NET exe"},"hashes":{"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","md5":"cbeb517b53913ab39c8ba111dd5a3207","pehash":"3c654c4c85dcba5b9b876dd5dc1866532f9554a8","sha1":"23779925ad3e8f1f0406de5163b4dc3664cda102","sha256":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","sha512":"71d8c31aff81c29f57f8d3d14bda47043b49d06b969bb2cfec6c88af37161c0d786dd8b47bb037ae163f1332dcd0659031d7ed5205818e8e76122d0802057f67","ssdeep":"12288:1FLofC1PyEWOwMH+O21d3Z7Ja5GMJPyDPXnq8LczaEeNBKLYs65cJde6t4Wcm7:1FZ19WOwMeV9IzJqDP3PLczKBKk3wdeW","ssdeep_chunks":["12288:1FLofC1","12288:FLofC1P","12288:LofC1Py","12288:ofC1PyE","12288:fC1PyEW","12288:C1PyEWO","12288:1PyEWOw","12288:PyEWOwM","12288:yEWOwMH","12288:EWOwMH+","12288:WOwMH+O","12288:OwMH+O2","12288:wMH+O21","12288:MH+O21d","12288:H+O21d3","12288:+O21d3Z","12288:O21d3Z7","12288:21d3Z7J","12288:1d3Z7Ja","12288:d3Z7Ja5","12288:3Z7Ja5G","12288:Z7Ja5GM","12288:7Ja5GMJ","12288:Ja5GMJP","12288:a5GMJPy","12288:5GMJPyD","12288:GMJPyDP","12288:MJPyDPX","12288:JPyDPXn","12288:PyDPXnq","12288:yDPXnq8","12288:DPXnq8L","12288:PXnq8Lc","12288:Xnq8Lcz","12288:nq8Lcza","12288:q8LczaE","12288:8LczaEe","12288:LczaEeN","12288:czaEeNB","12288:zaEeNBK","12288:aEeNBKL","12288:EeNBKLY","12288:eNBKLYs","12288:NBKLYs6","12288:BKLYs65","12288:KLYs65c","12288:LYs65cJ","12288:Ys65cJd","12288:s65cJde","12288:65cJde6","12288:5cJde6t","12288:cJde6t4","12288:Jde6t4W","12288:de6t4Wc","12288:e6t4Wcm","12288:6t4Wcm7","24576:1FLofC1","24576:FLofC1P","24576:LofC1Py","24576:ofC1PyE","24576:fC1PyEW","24576:C1PyEWO","24576:1PyEWOw","24576:PyEWOwM","24576:yEWOwMH","24576:EWOwMH+","24576:WOwMH+O","24576:OwMH+O2","24576:wMH+O21","24576:MH+O21d","24576:H+O21d3","24576:+O21d3Z","24576:O21d3Z7","24576:21d3Z7J","24576:1d3Z7Ja","24576:d3Z7Ja5","24576:3Z7Ja5G","24576:Z7Ja5GM","24576:7Ja5GMJ","24576:Ja5GMJP","24576:a5GMJPy","24576:5GMJPyD","24576:GMJPyDP","24576:MJPyDPX","24576:JPyDPXn","24576:PyDPXnq","24576:yDPXnq8","24576:DPXnq8L","24576:PXnq8Lc","24576:Xnq8Lcz","24576:nq8Lcza","24576:q8LczaE","24576:8LczaEe","24576:LczaEeN","24576:czaEeNB","24576:zaEeNBK","24576:aEeNBKL","24576:EeNBKLY","24576:eNBKLYs","24576:NBKLYs6","24576:BKLYs65","24576:KLYs65c","24576:LYs65cJ","24576:Ys65cJd","24576:s65cJde","24576:65cJde6","24576:5cJde6t","24576:cJde6t4","24576:Jde6t4W","24576:de6t4Wc","24576:e6t4Wcm","24576:6t4Wcm7","12288:1FZ19WO","12288:FZ19WOw","12288:Z19WOwM","12288:19WOwMe","12288:9WOwMeV","12288:WOwMeV9","12288:OwMeV9I","12288:wMeV9Iz","12288:MeV9IzJ","12288:eV9IzJq","12288:V9IzJqD","12288:9IzJqDP","12288:IzJqDP3","12288:zJqDP3P","12288:JqDP3PL","12288:qDP3PLc","12288:DP3PLcz","12288:P3PLczK","12288:3PLczKB","12288:PLczKBK","12288:LczKBKk","12288:czKBKk3","12288:zKBKk3w","12288:KBKk3wd","12288:BKk3wde","12288:Kk3wdeW"]},"pe_metadata":{"embedded_file_count":2,"export_count":0,"import_count":0,"imported_dlls":null,"imported_functions":null,"is_dll":false,"is_packed":false,"section_count":3,"section_names":[".text",".rsrc",".reloc"],"sections":[{"name":".text","raw_size":675328,"virtual_address":"0x2000","virtual_size":675080},{"name":".rsrc","raw_size":1536,"virtual_address":"0xa8000","virtual_size":1492},{"name":".reloc","raw_size":512,"virtual_address":"0xaa000","virtual_size":12}]},"submissions":{"first_seen":1720179998000,"last_multi_scan":1787890587000,"last_seen":1787890587000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["6687dd1eb57ea2f40c055331","6a853dd83eb3dd27ef028a26"]},"schema_version":"1.0.9","sha256":"2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029","threat_score":100,"unified_at":"2026-09-01T20:11:41.944Z","unified_at_epoch_ms":1788293501944,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious FormBook.Generic Sample 2a005539d78a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2a005539d78a…. Malware family: FormBook.Generic. Threat score 100/100. 18/23 AV engines flagged this file. 25 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029"}],["$","meta","4",{"property":"og:title","content":"Malicious FormBook.Generic Sample 2a005539d78a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2a005539d78a…. Malware family: FormBook.Generic. Threat score 100/100. 18/23 AV engines flagged this file. 25 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2a005539d78a0c685832affb3bfbfba01de751fa8b6cdf02becddabfc89b9029"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious FormBook.Generic Sample 2a005539d78a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2a005539d78a…. Malware family: FormBook.Generic. Threat score 100/100. 18/23 AV engines flagged this file. 25 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]