26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Kryptic.Generic Sample 2b733276f28e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2b733276f28e…. Malware family: Kryptic.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","keywords":["Malicious","Kryptic.Generic","malware analysis","sandbox report","threat intelligence","2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5"],"about":{"@type":"SoftwareApplication","name":"A1DB2JVWGG.CNT.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Kryptic.Generic","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tad6,".exe" queries volume information of "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe" at 00000000-00006020-00000049-3974266 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00006020-00000049-4983059 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00006020-00000049-5569050 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00006020-00000049-10066459 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll" at 00000000-00006020-00000049-10089068 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00006020-00000049-35192960 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006020-00000049-53653555 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006020-00000049-53687074 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006020-00000049-53687476 "HRVPZj.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\HRVPZj.exe" at 00000000-00003608-00000049-3531088 "HRVPZj.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00003608-00000049-4550649 "HRVPZj.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00003608-00000049-5080808 "HRVPZj.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00003608-00000049-10330155 "HRVPZj.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll" at 00000000-00003608-00000049-1034926728:T6b2,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "")29:T41e,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2a:Tb43,".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "This Device" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") ".exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER")2b:T8ee,"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "HRVPZj.exe.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"2c:T53f,Observed system executable string:"\Device\HarddiskVolume2\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006020-00000BC0-139008462] Observed system executable string:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006020-00000C0C-137465590855] Observed system executable string:""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\2b733276f28e8a547f7e2197e1be209c13" [Source: 00000000-00006020-00000C0C-137465590855], Observed system executable string:""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\HAPUBWS\AppData\Roaming\HRVP" [Source: 00000000-00006020-00000C0C-138655775628] Observed system executable string:"C:\Windows\System32\schtasks.exe" [Source: 00000000-00006020-00000C0C-139718177299] Observed system executable string:""C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HRVPZj" /XML "C:\Users\HAPUBWS\AppData\Local\Temp\tmp4D58.tmp"" [Source: 00000000-00006020-00000C0C-139718177299] Observed system executable string:"\Device\HarddiskVolume2\Windows\System32\conhost.exe" [Source: 00000000-00001092-00000BC0-139226377] Observed system executable string:"\Device\HarddiskVolume2\Windows\SysWOW64\WerFault.exe" [Source: 00000000-00001092-00000BC0-165580779]2d:T7d2,Process "powershell.exe" (UID: 00000000-00001092) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00001092) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00000496) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00000496) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "WerFault.exe" (UID: 00000000-00004704) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "WerFault.exe" (UID: 00000000-00004704) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00000064) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00000064) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "WerFault.exe" (UID: 00000000-00001280) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "WerFault.exe" (UID: 00000000-00001280) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006600) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "WerFault.exe" (UID: 00000000-00006600) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "HRVPZj.exe" (UID: 00000000-00003608) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", PROMPT="$P$G"" Process "HRVPZj.exe" (UID: 00000000-00003608) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles"2e:T471,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\2b733276f28e8a547f7e2197e1be ..." (UID: 00000000-00001092), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\HRVPZj.exe"" (UID: 00000000-00001972), Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\HRVPZj" /XML "%TEMP%\tmp4D58.tmp"" (UID: 00000000-00003680), Spawned process ".exe" (UID: 00000000-00004032), Spawned process "WerFault.exe" with commandline "-u -p 6020 -s 1220" (UID: 00000000-00000496), Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1200" (UID: 00000000-00003968), Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1200" (UID: 00000000-00004704), Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1700" (UID: 00000000-00000064), Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1700" (UID: 00000000-00001280), Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1404" (UID: 00000000-00006600), Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1692" (UID: 00000000-00002524)2f:T471,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\2b733276f28e8a547f7e2197e1be ..." (UID: 00000000-00001092), Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\HRVPZj.exe"" (UID: 00000000-00001972), Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\HRVPZj" /XML "%TEMP%\tmp4D58.tmp"" (UID: 00000000-00003680), Spawned process ".exe" (UID: 00000000-00004032), Spawned process "WerFault.exe" with commandline "-u -p 6020 -s 1220" (UID: 00000000-00000496), Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1200" (UID: 00000000-00003968), Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1200" (UID: 00000000-00004704), Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1700" (UID: 00000000-00000064), Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1700" (UID: 00000000-00001280), Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1404" (UID: 00000000-00006600), Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1692" (UID: 00000000-00002524)30:T804,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll"31:T766,".exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\2B733276F28E8A547F7E2197E1BE209C13718D5371922855264D1A5511CA66A5.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2B733276F28E8A547F7E2197E1BE209C13718D5371922855264D1A5511CA66A5.EXE.LOG" ".exe" trying to access non-existent file "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\DAOIUMP" ".exe" trying to access non-existent file "C:\2B733276F28E8A547F7E2197E1BE209C13718D5371922855264D1A5511CA66A5.INI" ".exe" trying to access non-existent file "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" ".exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING"32:T84b,".exe" called "FindFirstFileW" with parameter C:\Windows\Microsoft.NET\Framework\\* (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006020) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006020)33:T6bc,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")34:T624,".exe" queried SystemProcessInformation at 00000000-00006020-00000036-755702 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-756991 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-8045416 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-8046949 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-39672081 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-39674634 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-41642543 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-43611526 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-45580136 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-47548919 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-49517815 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-51486680 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-53455591 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-55433321 ".exe" queried SystemProcessInformation at 00000000-00006020-00000036-57414141 "HRVPZj.exe" queried SystemProcessInformation at 00000000-00003608-00000036-8248279 "HRVPZj.exe" queried SystemProcessInformation at 00000000-00003608-00000036-824933835:Ta17,".exe" wrote bytes "409b9c76c09b9c76" to virtual address "0x77CBE1C8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "00eb9b76f0ea9b76e00f9c76e0ea9b76900f9c7630eb9b76b0eb9b76f0db9b76700e9c7670eb9b76d0019c76" to virtual address "0x77CBE208" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "e9cbe926fb" to virtual address "0x7476BD30" ("GetKeyState@USER32.DLL") ".exe" wrote bytes "e93bff26fb" to virtual address "0x7476ADF0" ("GetWindowTextW@USER32.DLL") ".exe" wrote bytes "80759c7650789c76600b9b76f0749c76b0759c7610299b76e0749c7610759c76500b9b7600759c76" to virtual address "0x77CBE144" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "50169c76c0859b76" to virtual address "0x77CBE184" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "0070de6d" to virtual address "0x747E4EEC" (part of module "USER32.DLL") ".exe" wrote bytes "e97b5626fb" to virtual address "0x74775960" ("EnumWindows@USER32.DLL") ".exe" wrote bytes "d04c9e76d0159b76a0769b7640189b76" to virtual address "0x77CBE190" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "e92b1f7efe" to virtual address "0x711E7C00" (part of module "APPHELP.DLL") ".exe" wrote bytes "f0769f76e0779f7640769f76f0759f7630789f7610159c76b05e9f7680789f7690779f7690769f76605e9f7640779f76" to virtual address "0x77CBE1D4" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "0070de6d" to virtual address "0x74753010" (part of module "WIN32U.DLL") ".exe" wrote bytes "e99bad26fb" to virtual address "0x7476F850" ("GetAsyncKeyState@USER32.DLL") ".exe" wrote bytes "e93bfd26fb" to virtual address "0x7476AD50" ("GetWindowTextA@USER32.DLL") ".exe" wrote bytes "e98bbe25fb" to virtual address "0x7477E990" ("GetForegroundWindow@USER32.DLL") ".exe" wrote bytes "a0926203b0926203b017010080f00600c0020100b0f0060060b20600e0916203f0916203" to virtual address "0x747DAC94" (part of module "USER32.DLL") ".exe" wrote bytes "0070de6d" to virtual address "0x77CB8AA0" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "072951e8" to virtual address "0x6EF4F798" (part of module "CLR.DLL") ".exe" wrote bytes "30ae3377" to virtual address "0x74BA1094" (part of module "RPCRT4.DLL") ".exe" wrote bytes "20909c7650949c7640929c7620919c7600959c76009b9c76b0939c76809a9c76" to virtual address "0x77CBE1A4" (part of module "KERNELBASE.DLL")36:T60d,".exe" wrote 4024 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1676) ".exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1676) ".exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1676) ".exe" wrote 4024 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1692) ".exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1692) ".exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1692) ".exe" wrote 4024 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1660) ".exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1660) ".exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1660) ".exe" wrote 4024 bytes to a remote process "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe" (Handle: 1348) ".exe" wrote 8 bytes to a remote process "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe" (Handle: 1348) ".exe" wrote 4 bytes to a remote process "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe" (Handle: 1348)37:T50c,Spawned process ".exe" (UID: 00000000-00006020) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "C:\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe"" (UID: 00000000-00001092) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath "%APPDATA%\HRVPZj.exe"" (UID: 00000000-00001972) Spawned process "schtasks.exe" with commandline "/Create /TN "Updates\HRVPZj" /XML "%TEMP%\tmp4D58.tmp"" (UID: 00000000-00003680) Spawned process ".exe" (UID: 00000000-00004032) Spawned process "WerFault.exe" with commandline "-u -p 6020 -s 1220" (UID: 00000000-00000496) Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1200" (UID: 00000000-00003968) Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1200" (UID: 00000000-00004704) Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1700" (UID: 00000000-00000064) Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1700" (UID: 00000000-00001280) Spawned process "WerFault.exe" with commandline "-u -p 1972 -s 1404" (UID: 00000000-00006600) Spawned process "WerFault.exe" with commandline "-u -p 1092 -s 1692" (UID: 00000000-00002524) Spawned process "HRVPZj.exe" (UID: 00000000-00003608)38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/////////4h2f//////////////4h3ZmZn//////////+Ih3ZmZmZmZ/////////d3ZmZmZmZmZmf////////2ZmZmZmZmZmZmZmZmZmZmZ3ZmZmZmZmZmZ4iIiIiIhyd2ZmZmZmZmZmeIiPiIiPgndmZmZmZmZmZmZif2JmKIJ3dmZmZmZmZmZmYn9iZiiCd3dmZmZndmZmeIiPiIiPgnd2eIdmj4ZmZniIj4iIj4J3d2j4Z/9mZmZmYn9mZiiCd3dn/3j3ZmZmZmJ/ZmYognd3do//hmZmZniIj4iIj4J3d3Z//3ZmZmZ4iI+IiI+Cd3d3aP9mZmZmZmJ/ZmYognd3dn//hmZmZmZif2ZmKIZ3d3aPj/dmZmZ4iI+IiI+Gd3dn/3j4ZmZmeIiPiIiPhnd3ePhn/3ZmZmZif2ZmKIJ3d3eHZo+GZmZmYn9mZiiGd3d2ZmZmZmZmeIiPiIiPhnd3d3ZmZmZmZniIj4iIj4Z3d3d2ZmZmZmZmYn9mZiiGd3d3dmZmZmZmZmJ/ZmYohnd3d3ZmZmZmZniI/4iIj4Z3d3d3ZmZmZmZ4iIiIiIh2d3d3d3ZmZmZmZmZmZmZmZod3ZmZmdmZmZn///////////4h3dmZmZmZ///////////////iHd2Zmf/////////////////+Ih3////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/////////4h2f//////////////4h3ZmZn//////////+Ih3ZmZmZmZ/////////d3ZmZmZmZmZmf////////2ZmZmZmZmZmZmZmZmZmZmZ3ZmZmZmZmZmZ4iIiIiIhyd2ZmZmZmZmZmeIiPiIiPgndmZmZmZmZmZmZif2JmKIJ3dmZmZmZmZmZmYn9iZiiCd3dmZmZndmZmeIiPiIiPgnd2eIdmj4ZmZniIj4iIj4J3d2j4Z/9mZmZmYn9mZiiCd3dn/3j3ZmZmZmJ/ZmYognd3do//hmZmZniIj4iIj4J3d3Z//3ZmZmZ4iI+IiI+Cd3d3aP9mZmZmZmJ/ZmYognd3dn//hmZmZmZif2ZmKIZ3d3aPj/dmZmZ4iI+IiI+Gd3dn/3j4ZmZmeIiPiIiPhnd3ePhn/3ZmZmZif2ZmKIJ3d3eHZo+GZmZmYn9mZiiGd3d2ZmZmZmZmeIiPiIiPhnd3d3ZmZmZmZniIj4iIj4Z3d3d2ZmZmZmZmYn9mZiiGd3d3dmZmZmZmZmJ/ZmYohnd3d3ZmZmZmZniI/4iIj4Z3d3d3ZmZmZmZ4iIiIiIh2d3d3d3ZmZmZmZmZmZmZmZod3ZmZmdmZmZn///////////4h3dmZmZmZ///////////////iHd2Zmf/////////////////+Ih3////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791216298432,"unified_at":"2026-10-05T16:04:58.432Z","metadata":{"hashes":{"sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","sha1":"6a2604e432c74aa662fd3fa9b7b31f123f624ed8","md5":"4b271fd529c4540f4306808cc333ab06","sha512":"d2f635bbfd6c12380b4b82dc5783806495087dfaa196831743d708bdb8bd44ca8f7bf0391a00d8154db7b912051303b44b9568f471f81621c1b3ffc506e52f41","ssdeep":"24576:Qky9IISMoa5nCnabmOE2tVvJYE3pJBeK549dUQ5ugKTyN5yWTrvyEXtmJQ:IZDGE3pqU49z5F7TyIy6m","ssdeep_chunks":["24576:Qky9IIS","24576:ky9IISM","24576:y9IISMo","24576:9IISMoa","24576:IISMoa5","24576:ISMoa5n","24576:SMoa5nC","24576:Moa5nCn","24576:oa5nCna","24576:a5nCnab","24576:5nCnabm","24576:nCnabmO","24576:CnabmOE","24576:nabmOE2","24576:abmOE2t","24576:bmOE2tV","24576:mOE2tVv","24576:OE2tVvJ","24576:E2tVvJY","24576:2tVvJYE","24576:tVvJYE3","24576:VvJYE3p","24576:vJYE3pJ","24576:JYE3pJB","24576:YE3pJBe","24576:E3pJBeK","24576:3pJBeK5","24576:pJBeK54","24576:JBeK549","24576:BeK549d","24576:eK549dU","24576:K549dUQ","24576:549dUQ5","24576:49dUQ5u","24576:9dUQ5ug","24576:dUQ5ugK","24576:UQ5ugKT","24576:Q5ugKTy","24576:5ugKTyN","24576:ugKTyN5","24576:gKTyN5y","24576:KTyN5yW","24576:TyN5yWT","24576:yN5yWTr","24576:N5yWTrv","24576:5yWTrvy","24576:yWTrvyE","24576:WTrvyEX","24576:TrvyEXt","24576:rvyEXtm","24576:vyEXtmJ","24576:yEXtmJQ","49152:Qky9IIS","49152:ky9IISM","49152:y9IISMo","49152:9IISMoa","49152:IISMoa5","49152:ISMoa5n","49152:SMoa5nC","49152:Moa5nCn","49152:oa5nCna","49152:a5nCnab","49152:5nCnabm","49152:nCnabmO","49152:CnabmOE","49152:nabmOE2","49152:abmOE2t","49152:bmOE2tV","49152:mOE2tVv","49152:OE2tVvJ","49152:E2tVvJY","49152:2tVvJYE","49152:tVvJYE3","49152:VvJYE3p","49152:vJYE3pJ","49152:JYE3pJB","49152:YE3pJBe","49152:E3pJBeK","49152:3pJBeK5","49152:pJBeK54","49152:JBeK549","49152:BeK549d","49152:eK549dU","49152:K549dUQ","49152:549dUQ5","49152:49dUQ5u","49152:9dUQ5ug","49152:dUQ5ugK","49152:UQ5ugKT","49152:Q5ugKTy","49152:5ugKTyN","49152:ugKTyN5","49152:gKTyN5y","49152:KTyN5yW","49152:TyN5yWT","49152:yN5yWTr","49152:N5yWTrv","49152:5yWTrvy","49152:yWTrvyE","49152:WTrvyEX","49152:TrvyEXt","49152:rvyEXtm","49152:vyEXtmJ","49152:yEXtmJQ","24576:IZDGE3p","24576:ZDGE3pq","24576:DGE3pqU","24576:GE3pqU4","24576:E3pqU49","24576:3pqU49z","24576:pqU49z5","24576:qU49z5F","24576:U49z5F7","24576:49z5F7T","24576:9z5F7Ty","24576:z5F7TyI","24576:5F7TyIy","24576:F7TyIy6","24576:7TyIy6m"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"A1DB2JVWGG.CNT.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2042368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1676975707000,"last_seen":1677040976000,"last_multi_scan":1677040976000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["credentialharvesting","criminal","darkcomet","downloader","informationstealer","nanocore","ransomware","targeted","targetedcrimeware"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":30},"sandbox_signatures":{"informative_count":47,"suspicious_count":16,"malicious_count":10,"total":73},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1251645","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptic.18","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptic.18 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AIDL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.AgentTesla.jd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0059f4231 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.MSIL.Agensla.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Kryptic.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"system.reflection.load\" in \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\"\n Observed function \"system.reflection.load\" in \"HRVPZj.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"system\" and MemberReference \"getmethods\" in \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\"\n Observed namespace \"system\" and MemberReference \"getmethods\" in \"HRVPZj.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"tostring\" in \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\"\n Observed function \"concat\" in \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\"\n Observed function \"replace\" in \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\"\n Observed function \"split\" in \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\"\n Observed function \"tostring\" in \"HRVPZj.exe.bin\"\n Observed function \"concat\" in \"HRVPZj.exe.bin\"\n Observed function \"replace\" in \"HRVPZj.exe.bin\"\n Observed function \"split\" in \"HRVPZj.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"6020\" - (UID: 00000000-00006020)\n \"powershell.exe\" called \"IsWow64Process\" (UID: 00000000-00001092)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1972\" - (UID: 00000000-00001972)\n \"HRVPZj.exe\" called \"IsWow64Process\" with parameter \"3608\" - (UID: 00000000-00003608)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00006020)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"AIFGcYLKlhILhAOtBwnxwu\" - (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"powershell.exe\" called \"LookupAccountSidW\" with parameter \"NETWORK SERVICE\" - (UID: 00000000-00001092)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006020)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001092)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001972)\n \"HRVPZj.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003608)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"schtasks.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"HRVPZj.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"HRVPZj.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"HRVPZj.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe\"\n Report process \"WerFault.exe\" was created by \"powershell.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\".exe\" called \"CopyFileW\" with parameter %APPDATA%\\HRVPZj.exe (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\2b733276f28e8a547f7e2197e1be209c13\" - (UID: 00000000-00006020), \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\HRVP\" - (UID: 00000000-00006020)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\HRVPZj\" /XML \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\tmp4D58.tmp\"\" - (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6020:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6020:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\AIFGcYLKlhILhAOtBwnxwu\"\n \"Local\\SM0:6020:64:WilError_01\"\n \"Global\\SyncRootManager\"\n \"Local\\SM0:6020:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"AIFGcYLKlhILhAOtBwnxwu\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1092:168:WilStaging_02\"\n \"Local\\SM0:1092:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C950000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C950000\n \"HRVPZj.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C1A0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\" has an executable section named \".text\"\n \"HRVPZj.exe.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2b","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x188400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x18828c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"$2c","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$2d","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2e","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$2f","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"HRVPZj.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"HRVPZj.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\HRVPZj.exe]- [targetUID: 00000000-00006020]\n \"tmp4D58.tmp\" has type \"XML 1.0 document ASCII text\"- Location: [%TEMP%\\tmp4D58.tmp]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006020)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001092)\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001972)\n \"HRVPZj.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003608)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\".exe\" called \"GetComputerNameW\" (UID: 00000000-00006020)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001092)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00001972)\n \"schtasks.exe\" called \"GetComputerNameW\" (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\".exe\" called \"GetUserNameW\" (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"HRVPZj.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe\"\" (UID: 00000000-00001092)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\HRVPZj.exe\"\" (UID: 00000000-00001972)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"HRVPZj.exe\" - Location: [%APPDATA%\\HRVPZj.exe]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"HRVPZj.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00006020-00000036-55882849","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$34","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights\n \"HRVPZj.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.89542822486\n 7.89542822486","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe\"\" (UID: 00000000-00001092)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\HRVPZj.exe\"\" (UID: 00000000-00001972)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" reads file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" reads file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" reads file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \".exe\" reads file \"%USERPROFILE%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"HRVPZj.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"HRVPZj.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\HRVPZj.exe]- [targetUID: 00000000-00006020]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Windows.Forms.Control::set_TabIndex at 4b271fd529c4540f4306808cc333ab06-6000006-Form1~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex at 4b271fd529c4540f4306808cc333ab06-600000d-Form2~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"16.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00006020)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00001092)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%TEMP%\\tmp4D58.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\tmp4D58.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$35","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"HRVPZj.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"HRVPZj.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\2b733276f28e8a547f7e2197e1be209c13\" - (UID: 00000000-00006020), \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\HRVP\" - (UID: 00000000-00006020)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\HRVPZj\" /XML \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\tmp4D58.tmp\"\" - (UID: 00000000-00006020)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/70 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"46/70 Antivirus vendors marked dropped file \"HRVPZj.exe.bin\" as malicious (classified as \"Gen:Variant.Kryptic\" with 65% detection rate)\n 46/70 Antivirus vendors marked dropped file \"HRVPZj.exe\" as malicious (classified as \"Gen:Variant.Kryptic\" with 65% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"46/70 Antivirus vendors marked spawned process \".exe\" (PID: 4032) as malicious (classified as \"Gen:Variant.Kryptic\" with 65% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 70310000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\HRVPZj\" /XML \"%TEMP%\\tmp4D58.tmp\"\" (UID: 00000000-00003680)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$36","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$37","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the windows installation language"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["credentialharvesting","criminal","darkcomet","downloader","informationstealer","nanocore","ransomware","targeted","targetedcrimeware"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"63f59a9b80c1ff07d6052716","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Kryptic","submit_name":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe","analysis_start_time":"2023-02-22T04:31:24+00:00","indicators_count":{"informative":47,"suspicious":25,"malicious":10},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}],"processes":[{"pid":6020,"ppid":0,"name":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe","command_line":"","sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","normalized_path":"C:\\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe","uid":"00000000-00006020","icon":"$38"},{"pid":1092,"ppid":6020,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"C:\\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006020","uid":"00000000-00001092"},{"pid":64,"ppid":1092,"name":"WerFault.exe","command_line":"-u -p 1092 -s 1700","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001092","uid":"00000000-00000064"},{"pid":1280,"ppid":1092,"name":"WerFault.exe","command_line":"-u -p 1092 -s 1700","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001092","uid":"00000000-00001280"},{"pid":2524,"ppid":1092,"name":"WerFault.exe","command_line":"-u -p 1092 -s 1692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001092","uid":"00000000-00002524"},{"pid":1972,"ppid":6020,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"%APPDATA%\\HRVPZj.exe\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006020","uid":"00000000-00001972"},{"pid":3968,"ppid":1972,"name":"WerFault.exe","command_line":"-u -p 1972 -s 1200","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001972","uid":"00000000-00003968"},{"pid":4704,"ppid":1972,"name":"WerFault.exe","command_line":"-u -p 1972 -s 1200","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001972","uid":"00000000-00004704"},{"pid":6600,"ppid":1972,"name":"WerFault.exe","command_line":"-u -p 1972 -s 1404","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001972","uid":"00000000-00006600"},{"pid":3680,"ppid":6020,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\HRVPZj\" /XML \"%TEMP%\\tmp4D58.tmp\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00006020","uid":"00000000-00003680"},{"pid":4032,"ppid":6020,"name":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe","command_line":"","sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","normalized_path":"C:\\2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5.exe","parent_uid":"00000000-00006020","uid":"00000000-00004032"},{"pid":496,"ppid":6020,"name":"WerFault.exe","command_line":"-u -p 6020 -s 1220","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006020","uid":"00000000-00000496"},{"pid":3608,"ppid":0,"name":"HRVPZj.exe","command_line":"","sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","normalized_path":"%APPDATA%\\HRVPZj.exe","uid":"00000000-00003608","icon":"$39"}],"all_imported_dlls":["mscorrc.dll","bcryptprimitives.dll","windows.storage.dll","propsys.dll","Windows.StateRepositoryPS.dll","msIso.dll","sechost.dll","System.Configuration.ni.dll","cfgmgr32.dll","comctl32.dll","System.Data.dll","edputil.dll","urlmon.dll","fltLib.dll","ucrtbase_clr0400.dll","uxtheme.dll","System.ni.dll","dwmapi.dll","ntmarta.dll","ws2_32.dll","gdi32full.dll","GdiPlus.dll","wintrust.dll","amsi.dll","cldapi.dll","kernel32.dll","clr.dll","System.Core.ni.dll","System.Xml.ni.dll","SHCore.dll","bcrypt.dll","WindowsCodecs.dll","atl.dll","mscoree.dll","mscoreei.dll","user32.dll","imm32.dll","rsaenh.dll","rpcrt4.dll","win32u.dll","msctf.dll","ole32.dll","version.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","crypt32.dll","clbcatq.dll","wow64.dll","apphelp.dll","ucrtbase.dll","imagehlp.dll","iertutil.dll","gpapi.dll","KernelBase.dll","msvcp_win.dll","oleaut32.dll","kernel.appcore.dll","clrjit.dll","powrprof.dll","cryptsp.dll","msasn1.dll","userenv.dll","aepic.dll","winnlsres.dll","diasymreader.dll","wow64cpu.dll","cryptbase.dll","OneCoreUAPCommonProxyStub.dll","ntdll.dll","wow64win.dll","advapi32.dll","msvcrt.dll","shlwapi.dll","wldp.dll","taskschd.dll","gdi32.dll","shell32.dll","sspicli.dll","psapi.dll","profapi.dll","combase.dll","DWrite.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"HRVPZj.exe","sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"HRVPZj.exe.bin","sha256":"2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"tmp4D58.tmp","sha256":"35b5e9156749f75b4199340af0fa7633ae88c3e17159d1c3b9059bda400d0b83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"path":"%APPDATA%\\HRVPZj.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\\\","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\DESKTOP\\NAMESPACE\\DELEGATEFOLDERS\\\\","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6020:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AIFGcYLKlhILhAOtBwnxwu","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\SM0:6020:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\SM0:6020:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"AIFGcYLKlhILhAOtBwnxwu","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1092:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\SM0:1092:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\SM0:1972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3608:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3608:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\SM0:3608:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]},{"name":"Local\\SM0:3608:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f59a9b80c1ff07d6052716"}]}]}},"report_ids":{"sandbox_job_ids":["63f59a9b80c1ff07d6052716"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Kryptic.Generic Sample 2b733276f28e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2b733276f28e…. Malware family: Kryptic.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5"}],["$","meta","4",{"property":"og:title","content":"Malicious Kryptic.Generic Sample 2b733276f28e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2b733276f28e…. Malware family: Kryptic.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2b733276f28e8a547f7e2197e1be209c13718d5371922855264d1a5511ca66a5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Kryptic.Generic Sample 2b733276f28e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2b733276f28e…. Malware family: Kryptic.Generic. Threat score 100/100. 9/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]