24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_70% Sample 30577961b838… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 30577961b838…. Malware family: Win/grayware_confidence_70%. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/30577961b8385513744ff7dadade82b2a63f8fb2f4355dfa7ff13a067119d281","keywords":["Malicious","Win/grayware_confidence_70%","malware analysis","sandbox report","threat intelligence","30577961b8385513744ff7dadade82b2a63f8fb2f4355dfa7ff13a067119d281"],"about":{"@type":"SoftwareApplication","name":"165-018gx安装.exe","applicationCategory":["peexe","executable","compressed","sfx","7zip"],"identifier":"30577961b8385513744ff7dadade82b2a63f8fb2f4355dfa7ff13a067119d281","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_70%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5db,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000000.195853.07250000.00000004.mdmp, 00000000-00007924.00000000.195853.0773E000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.07250000.00000004.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp, 00000000-00007924.00000001.197774.0773E000.00000004.mdmp, 00000000-00007924.00000002.199693.07250000.00000004.mdmp, 00000000-00007924.00000002.199693.0773E000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000000.195853.07250000.00000004.mdmp, 00000000-00007924.00000000.195853.0773E000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.07250000.00000004.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp, 00000000-00007924.00000001.197774.0773E000.00000004.mdmp, 00000000-00007924.00000002.199693.07250000.00000004.mdmp, 00000000-00007924.00000002.199693.0773E000.00000004.mdmp")26:T6c3,"165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\CURVER") "165-018gx_.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\HTAFILE") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\HTAFILE\SHELLEX\ICONHANDLER") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\SHELLEX\ICONHANDLER") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.HTA") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTA") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\APPLICATION") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\APPLICATION") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\HTAFILE\DOCOBJECT") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\DOCOBJECT") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\HTAFILE\BROWSEINPLACE") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\BROWSEINPLACE") "165-018gx_.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\.HTA") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\.HTA") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.HTA") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\HTAFILE\CLSID") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\CLSID") "165-018gx_.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\HTAFILE\CLSID")27:T9cf,"165-018gx_.exe" queried SystemProcessInformation at 00000000-00000968-00000C15-2015772358 [PID: 968] "165-018gx_.exe" queried SystemProcessInformation at 00000000-00000968-00000C15-2015783152 [PID: 968] "2f2.exe" queried SystemProcessInformation at 00000000-00003276-00000C15-2021911206 [PID: 3276] "2f2.exe" queried SystemProcessInformation at 00000000-00003276-00000C15-2021919098 [PID: 3276] "2f2.exe" queried SystemProcessInformation at 00000000-00003276-00000C15-2022212963 [PID: 3276] "2f2.exe" queried SystemProcessInformation at 00000000-00003276-00000C15-2022220928 [PID: 3276] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030079844 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030090435 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030332576 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030340811 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030582637 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030591125 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030832721 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2030840118 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031082562 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031090035 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031332519 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031339844 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031582540 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031589792 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031832631 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2031839748 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2032082510 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2032089988 [PID: 7924] "0jJETMG.exe" queried SystemProcessInformation at 00000000-00007924-00000C15-2032332594 [PID: 7924]28:T320d,Found XOR loop in file "0jJETMG.exe" at offset 120068; code bytes = 8030 Found XOR loop in file "0jJETMG.exe" at offset 121346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 12244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 21582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 166390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 177470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 207858; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 271478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 314105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 351133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 367504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 407510; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 445375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 549021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 619386; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 659784; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 737146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 749822; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 843069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 858263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1020731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1078870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1402855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1472410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1477998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1498676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1542370; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1681171; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1786002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1790887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1872734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2054372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2323191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2407274; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2447768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2456598; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2494636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2653458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2682221; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2856197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2970869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3000934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3015476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3044216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3083700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3098888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3101287; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3188544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3257144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3395991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3420199; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 263007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 322972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 459651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 528008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 556975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 726874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 755383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 809209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 837697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1013404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1036513; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1066184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1176006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1337926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1568994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1640297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1649810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1656910; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1781954; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1912454; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1957190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2174340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2222040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2244503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2265247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2283153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2365425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2382928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2397223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2404246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2438686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2510339; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2514174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2571079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2617227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2638959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2676159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2683742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2688304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2715093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2736398; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2999189; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3024529; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3109442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3190060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3233097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3238764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3260318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3329637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8095; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 57786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 62707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 132001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 167590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 172353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 365926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 376406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 467363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 518291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 562250; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 587657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 597297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 745314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 821607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 865522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 892655; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 892981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 991414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 998785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1116098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1152355; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1187545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1256110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1270887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1302978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1437594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1450453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1491292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1507151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1639497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1651253; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1721123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1728903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1736538; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1776692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1796050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1814431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1937444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1948078; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1960658; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1982422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1985290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2036462; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2046540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2058609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2097028; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2147926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2155559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2251141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2282786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2318309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2413018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2449119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2487179; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2497879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2685397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2755870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2805468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2831009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2833217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2874363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2982752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3099884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3191798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3235128; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3379449; code bytes = 803029:T2030,"165-018gx_.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f8d4650538cfe477b439ec0264d56505010000006839ec02b439ec026839ec02040000000400000000e04e770010000064d56505010000006839ec02cd97e4779c97e477dd4f777fb50f45776839ec020000e47700000000940de9710000000080ee4b770100000000000000f8e24e77000000000400000080a9797448404d77f8e24e7768d5650580e87d777018ed0280e87d7764d565050000000080e87d776cb87402feffffff00000000000000000000000005000000801df10202000000020000000a000000701df102801df102000000004b26be07e8d76505ddf34277dcd5650500000000701df1020a000000f8f34277701df102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006816ef027c16ef02 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000008858f1020000ec020000ec028858f102088fec02088fec027f070000c000ec027026f10274d46505d2fbe27701000000ff070000eb2e00008858f1020000ec0200000000000000000000ec020000000000000000fc1d00004056f1020000ec0200000000388bad04088fec02088fec027f070000c000ec020000000000000000d2fbe27701000000ff070000342f00004056f1020000ec0200000000388bad0428d9650504d9650581f12e77388bad0440de6505d0da6505c5f12e770000ec029834e4774856f10230d965051c602b770400000028d965055c837277308bad04a090327700000000e4d5650500000000 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000be6af102d46af102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006505b8c065051b800800cc5682001402000000000000000000000000000098c065051b80080020c1650558060000c0c765051800000053f146d814020000000000009f5782731402000014020000000000000000000000006505000000000000000018000000c0c7650520c165051b800800fb8e46d830bf65059f57827348c06505a0188473a3c7a6aefeffffff58c06505222a55741402000000000000000000000000000030c065051b800800b8c065055806000058c76505642a5574bad84958f30b0000faffffff70c7650500000000180000000000000053f146d80000000000000000ffffffff0000000000000000000000005e27f1027627f102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006505b8c065051b800800cc5682001402000000000000000000000000000098c065051b80080020c1650558060000c0c765051800000053f146d814020000000000009f5782731402000014020000000000000000000000006505000000000000000018000000c0c7650520c165051b800800fb8e46d830bf65059f57827348c06505a0188473a3c7a6aefeffffff58c06505222a55741402000000000000000000000000000030c065051b800800b8c065055806000058c76505642a5574bad84958f30b0000faffffff70c7650500000000180000000000000053f146d80000000000000000ffffffff000000000000000000000000de7df102f27df102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006505b8c065051b800800cc5682001402000000000000000000000000000098c065051b80080020c1650558060000c0c765051800000053f146d814020000000000009f5782731402000014020000000000000000000000006505000000000000000018000000c0c7650520c165051b800800fb8e46d830bf65059f57827348c06505a0188473a3c7a6aefeffffff58c06505222a55741402000000000000000000000000000030c065051b800800b8c065055806000058c76505642a5574bad84958f30b0000faffffff70c7650500000000180000000000000053f146d80000000000000000ffffffff000000000000000000000000d6cef102eecef102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006505b8c065051b800800cc5682001402000000000000000000000000000098c065051b80080020c1650558060000c0c765051800000053f146d814020000000000009f5782731402000014020000000000000000000000006505000000000000000018000000c0c7650520c165051b800800fb8e46d830bf65059f57827348c06505a0188473a3c7a6aefeffffff58c06505222a55741402000000000000000000000000000030c065051b800800b8c065055806000058c76505642a5574bad84958f30b0000faffffff70c7650500000000180000000000000053f146d80000000000000000ffffffff0000000000000000000000007e62f1029462f102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006505b8c065051b800800cc5682001402000000000000000000000000000098c065051b80080020c1650558060000c0c765051800000053f146d814020000000000009f5782731402000014020000000000000000000000006505000000000000000018000000c0c7650520c165051b800800fb8e46d830bf65059f57827348c06505a0188473a3c7a6aefeffffff58c06505222a55741402000000000000000000000000000030c065051b800800b8c065055806000058c76505642a5574bad84958f30b0000faffffff70c7650500000000180000000000000053f146d80000000000000000ffffffff000000000000000000000000f6cdf1020ecef102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006505b8c065051b800800cc5682001402000000000000000000000000000098c065051b80080020c1650558060000c0c765051800000053f146d814020000000000009f5782731402000014020000000000000000000000006505000000000000000018000000c0c7650520c165051b800800fb8e46d830bf65059f57827348c06505a0188473a3c7a6aefeffffff58c06505222a55741402000000000000000000000000000030c065051b800800b8c065055806000058c76505642a5574bad84958f30b0000faffffff70c7650500000000180000000000000053f146d80000000000000000ffffffff00000000000000000000000056e1f1026ee1f102 (UID: 00000000-00000968) "165-018gx_.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000060b965051b800800e8b965055806000088c06505180000002b8846d814020000000000009f5782730000000014020000000000000000000060b9650500000000000000001800000000006505e8b965051b800800cc56820014020000000000000000000000000000c8b965051b80080050ba650558060000f0c0650518000000838846d814020000000000009f57827314020000140200000000000000000000c8b96505000000000000000018000000f0c0650550ba65051b8008002b8846d860b865059f57827378b96505a01884730000000000000000ffffffff0000000000000000000000006637f2027e37f202 (UID: 00000000-00000968)2a:T9d3,"165-018gx_.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000968) "165-018gx_.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000968) "2f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003276) "2f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003276) "2f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003276) "2f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003276) "0jJETMG.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007924) "0jJETMG.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007924)2b:T8119,"165-018gx_.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CompareFileTime (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter StretchBlt (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetStretchBltMode (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _controlfp (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ?terminate@@YAXXZ (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _purecall (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __CxxFrameHandler (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _wtol (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _wcsnicmp (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _beginthreadex (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _except_handler3 (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __dllonexit (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _c_exit (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _XcptFilter (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _acmdln (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SHBrowseForFolderW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DialogBoxIndirectParamW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DrawIconEx (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter wvsprintfW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter MessageBeep (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter CopyImage (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetMenu (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00000968) "165-018gx_.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00000968) "2f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003276) "2f2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003276) "0jJETMG.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007924) "0jJETMG.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007924)2c:T4f0,Found reference to API "warning: CreateFile() error %d (set file times for %s)" (Indicator: "CreateFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "CreateFile() error %d when trying set file time" (Indicator: "CreateFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "REGEDIT: CreateFile failed, GetLastError() = %d" (Indicator: "CreateFile"; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API "CreateFileTransactedA" (Indicator: "CreateFile"; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp")2d:T46bc,Found reference to API (Indicator: "GetStdHandle"; File: "165-018gx.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "165-018gx.exe") Found reference to API (Indicator: "GetProcAddress"; File: "165-018gx.exe") Found reference to API (Indicator: "VirtualProtect"; File: "165-018gx.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "165-018gx.exe") Found reference to API (Indicator: "VirtualFree"; File: "165-018gx.exe") Found reference to API (Indicator: "ExitProcess"; File: "165-018gx.exe") Found reference to API (Indicator: "DeleteDC"; File: "165-018gx.exe") Found reference to API (Indicator: "CoInitialize"; File: "165-018gx.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "165-018gx.exe") Found reference to API (Indicator: "GetDC"; File: "165-018gx.exe") Found reference to API (Indicator: "Beep"; Source: "00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetVolumeLabelA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "OemToCharA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CharToOemA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidAcl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API (Indicator: "ShellExecute"; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API (Indicator: "CreateFileTransactedA"; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp")2e:T2505,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "REG QUERY HKLM\Software\Microsoft\ResKit /v Version" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /s" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG ADD \\ABC\HKLM\Software\MyCo" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Adds a key HKLM\Software\MyCo on remote machine ABC" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG ADD HKLM\Software\MyCo /v MRU /t REG_MULTI_SZ /d fax\0mail" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d %"systemroot"%" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG DELETE HKLM\Software\MyCo\MyApp\Timeout" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG DELETE \\ZODIAC\HKLM\Software\MyCo /v MTU" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp /s" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG COPY \\ZODIAC\HKLM\Software\MyCo HKLM\Software\MyCo1" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG SAVE \\ZODIAC\HKLM\Software\MyCo MyCoBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG RESTORE HKLM\Software\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG RESTORE \\ZODIAC\HKLM\Sofware\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG LOAD HKLM\TempHive TempHive.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Loads the file TempHive.hiv to the Key HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG LOAD \\ZODIAC\HKLM\TempHive Back.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Loads the file Back.hiv on ZODIAC to the key HKLM\TempHive on ZODIAC" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG UNLOAD HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG UNLOAD \\ZODIAC\HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG COMPARE HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG COMPARE HKLM\Software\MyCo HKLM\Software\MyCo1 /v Version" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG COMPARE \\ZODIAC\HKLM\Software\MyCo \\. /s" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG EXPORT HKLM\Software\MyCo\MyApp AppBkUp.reg /nt4" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "REG EXPORT HKLM\Software\MyCo MyCoBkUp.reg" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp 00000000-00007924.00000000.195853.070C0000.00000004.mdmp 00000000-00007924.00000001.197774.07211000.00000002.mdmp 00000000-00007924.00000001.197774.076F6000.00000002.mdmp2f:T5d3,Process 165-018gx_.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:968:64:WilError_01" Process 165-018gx_.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:968:168:WilStaging_02" Process 165-018gx_.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:968:64:WilError_01" Process 165-018gx_.exe created mutex with name "Local\SM0:968:168:WilStaging_02" Process 165-018gx_.exe created mutex with name "Local\SM0:968:64:WilError_01" Process 165-018gx_.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 165-018gx_.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 165-018gx_.exe created mutex with name "SM0:968:64:WilError_01" Process 165-018gx_.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process 165-018gx_.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 165-018gx_.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 0jJETMG.exe created mutex with name "\Sessions\1\BaseNamedObjects\Mutex_8C0E7476" Process 0jJETMG.exe created mutex with name "Mutex_66949197" Process 0jJETMG.exe created mutex with name "DBWinMutex" Process 0jJETMG.exe created mutex with name "Mutex_8C0E7476" Process 0jJETMG.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process 0jJETMG.exe created mutex with name "\Sessions\1\BaseNamedObjects\Mutex_66949197"30:T53c6,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003276.00000000.195434.0CFA0000.00000002.mdmp "SOFTWARE\WOW6432Node\Alibaba\DingTalk" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\DingTalk" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "SOFTWARE\WOW6432Node\Tencent\WXWork" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Tencent\WXWork" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "SOFTWARE\WOW6432Node\Tencent\WeChat" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Tencent\WeChat" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "ADD "HKCU\Software\Classes\mscfile\shell\open\command" /ve /d "%s" /f" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Classes\mscfile\shell" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Classes\mscfile\shell\open" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Classes\mscfile\Cleanup" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "Software\Classes\mscfile" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit /v Version" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /s" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG ADD \\ABC\HKLM\Software\MyCo" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " Adds a key HKLM\Software\MyCo on remote machine ABC" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG ADD HKLM\Software\MyCo /v MRU /t REG_MULTI_SZ /d fax\0mail" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d %"systemroot"%" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG DELETE HKLM\Software\MyCo\MyApp\Timeout" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG DELETE \\ZODIAC\HKLM\Software\MyCo /v MTU" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp /s" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG COPY \\ZODIAC\HKLM\Software\MyCo HKLM\Software\MyCo1" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG SAVE \\ZODIAC\HKLM\Software\MyCo MyCoBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG RESTORE HKLM\Software\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG RESTORE \\ZODIAC\HKLM\Sofware\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG LOAD HKLM\TempHive TempHive.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " Loads the file TempHive.hiv to the Key HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG LOAD \\ZODIAC\HKLM\TempHive Back.hiv" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " Loads the file Back.hiv on ZODIAC to the key HKLM\TempHive on ZODIAC" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG UNLOAD HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG UNLOAD \\ZODIAC\HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG COMPARE HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG COMPARE HKLM\Software\MyCo HKLM\Software\MyCo1 /v Version" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG COMPARE \\ZODIAC\HKLM\Software\MyCo \\. /s" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG EXPORT HKLM\Software\MyCo\MyApp AppBkUp.reg /nt4" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp " REG EXPORT HKLM\Software\MyCo MyCoBkUp.reg" in Source: 00000000-00007924.00000000.195853.06D80000.00000004.mdmp "SOFTWARE\WOW6432Node\Alibaba\DingTalk" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\DingTalk" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "SOFTWARE\WOW6432Node\Tencent\WXWork" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Tencent\WXWork" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "SOFTWARE\WOW6432Node\Tencent\WeChat" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Tencent\WeChat" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "ADD "HKCU\Software\Classes\mscfile\shell\open\command" /ve /d "%s" /f" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Classes\mscfile\shell" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Classes\mscfile\shell\open" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Classes\mscfile\Cleanup" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "Software\Classes\mscfile" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit /v Version" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /s" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG ADD \\ABC\HKLM\Software\MyCo" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " Adds a key HKLM\Software\MyCo on remote machine ABC" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG ADD HKLM\Software\MyCo /v MRU /t REG_MULTI_SZ /d fax\0mail" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d %"systemroot"%" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG DELETE HKLM\Software\MyCo\MyApp\Timeout" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG DELETE \\ZODIAC\HKLM\Software\MyCo /v MTU" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp /s" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG COPY \\ZODIAC\HKLM\Software\MyCo HKLM\Software\MyCo1" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG SAVE \\ZODIAC\HKLM\Software\MyCo MyCoBkUp.hiv" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG RESTORE HKLM\Software\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG RESTORE \\ZODIAC\HKLM\Sofware\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG LOAD HKLM\TempHive TempHive.hiv" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " Loads the file TempHive.hiv to the Key HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG LOAD \\ZODIAC\HKLM\TempHive Back.hiv" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " Loads the file Back.hiv on ZODIAC to the key HKLM\TempHive on ZODIAC" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG UNLOAD HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG UNLOAD \\ZODIAC\HKLM\TempHive" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG COMPARE HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG COMPARE HKLM\Software\MyCo HKLM\Software\MyCo1 /v Version" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG COMPARE \\ZODIAC\HKLM\Software\MyCo \\. /s" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG EXPORT HKLM\Software\MyCo\MyApp AppBkUp.reg /nt4" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp " REG EXPORT HKLM\Software\MyCo MyCoBkUp.reg" in Source: 00000000-00007924.00000000.195853.070C0000.00000004.mdmp "SOFTWARE\WOW6432Node\Alibaba\DingTalk" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\DingTalk" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "SOFTWARE\WOW6432Node\Tencent\WXWork" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Tencent\WXWork" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "SOFTWARE\WOW6432Node\Tencent\WeChat" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Tencent\WeChat" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "ADD "HKCU\Software\Classes\mscfile\shell\open\command" /ve /d "%s" /f" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Classes\mscfile\shell" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Classes\mscfile\shell\open" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Classes\mscfile\Cleanup" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "Software\Classes\mscfile" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit /v Version" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /s" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG ADD \\ABC\HKLM\Software\MyCo" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " Adds a key HKLM\Software\MyCo on remote machine ABC" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG ADD HKLM\Software\MyCo /v MRU /t REG_MULTI_SZ /d fax\0mail" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d %"systemroot"%" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG DELETE HKLM\Software\MyCo\MyApp\Timeout" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG DELETE \\ZODIAC\HKLM\Software\MyCo /v MTU" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp /s" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG COPY \\ZODIAC\HKLM\Software\MyCo HKLM\Software\MyCo1" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG SAVE \\ZODIAC\HKLM\Software\MyCo MyCoBkUp.hiv" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG RESTORE HKLM\Software\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG RESTORE \\ZODIAC\HKLM\Sofware\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG LOAD HKLM\TempHive TempHive.hiv" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " Loads the file TempHive.hiv to the Key HKLM\TempHive" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG LOAD \\ZODIAC\HKLM\TempHive Back.hiv" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " Loads the file Back.hiv on ZODIAC to the key HKLM\TempHive on ZODIAC" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG UNLOAD HKLM\TempHive" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG UNLOAD \\ZODIAC\HKLM\TempHive" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG COMPARE HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG COMPARE HKLM\Software\MyCo HKLM\Software\MyCo1 /v Version" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG COMPARE \\ZODIAC\HKLM\Software\MyCo \\. /s" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG EXPORT HKLM\Software\MyCo\MyApp AppBkUp.reg /nt4" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp " REG EXPORT HKLM\Software\MyCo MyCoBkUp.reg" in Source: 00000000-00007924.00000001.197774.07211000.00000002.mdmp "SOFTWARE\WOW6432Node\Alibaba\DingTalk" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\DingTalk" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "SOFTWARE\WOW6432Node\Tencent\WXWork" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Tencent\WXWork" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "SOFTWARE\WOW6432Node\Tencent\WeChat" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Tencent\WeChat" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Classes\mscfile\shell\open\command" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "ADD "HKCU\Software\Classes\mscfile\shell\open\command" /ve /d "%s" /f" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Classes\mscfile\shell" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Classes\mscfile\shell\open" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Classes\mscfile\Cleanup" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "Software\Classes\mscfile" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit /v Version" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG QUERY HKLM\Software\Microsoft\ResKit\Nt\Setup /s" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG ADD \\ABC\HKLM\Software\MyCo" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " Adds a key HKLM\Software\MyCo on remote machine ABC" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG ADD HKLM\Software\MyCo /v Data /t REG_BINARY /d fe340ead" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG ADD HKLM\Software\MyCo /v MRU /t REG_MULTI_SZ /d fax\0mail" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG ADD HKLM\Software\MyCo /v Path /t REG_EXPAND_SZ /d %"systemroot"%" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG DELETE HKLM\Software\MyCo\MyApp\Timeout" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG DELETE \\ZODIAC\HKLM\Software\MyCo /v MTU" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG COPY HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp /s" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG COPY \\ZODIAC\HKLM\Software\MyCo HKLM\Software\MyCo1" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG SAVE HKLM\Software\MyCo\MyApp AppBkUp.hiv" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG SAVE \\ZODIAC\HKLM\Software\MyCo MyCoBkUp.hiv" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG RESTORE HKLM\Software\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG RESTORE \\ZODIAC\HKLM\Sofware\Microsoft\ResKit NTRKBkUp.hiv" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG LOAD HKLM\TempHive TempHive.hiv" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " Loads the file TempHive.hiv to the Key HKLM\TempHive" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG LOAD \\ZODIAC\HKLM\TempHive Back.hiv" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " Loads the file Back.hiv on ZODIAC to the key HKLM\TempHive on ZODIAC" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG UNLOAD HKLM\TempHive" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG UNLOAD \\ZODIAC\HKLM\TempHive" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG COMPARE HKLM\Software\MyCo\MyApp HKLM\Software\MyCo\SaveMyApp" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG COMPARE HKLM\Software\MyCo HKLM\Software\MyCo1 /v Version" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG COMPARE \\ZODIAC\HKLM\Software\MyCo \\. /s" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " Compares all subkeys and values under HKLM\Software\MyCo on ZODIAC" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG EXPORT HKLM\Software\MyCo\MyApp AppBkUp.reg /nt4" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp " REG EXPORT HKLM\Software\MyCo MyCoBkUp.reg" in Source: 00000000-00007924.00000001.197774.076F6000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\EventLog\" in Source: 00000000-00007924.00000002.199693.6BC1C000.00000002.mdmp31:Te39,"165-018gx_.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77340000 "165-018gx_.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77340000 "165-018gx_.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77340000 "165-018gx_.exe" loaded module "KERNEL32" at base 75320000 "165-018gx_.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 737c0000 "165-018gx_.exe" loaded module "KERNEL32.DLL" at base 75320000 "165-018gx_.exe" loaded module "GDI32.DLL" at base 75980000 "165-018gx_.exe" loaded module "MSVCRT.DLL" at base 74da0000 "165-018gx_.exe" loaded module "OLE32.DLL" at base 77110000 "165-018gx_.exe" loaded module "OLEAUT32.DLL" at base 77070000 "165-018gx_.exe" loaded module "SHELL32.DLL" at base 759b0000 "165-018gx_.exe" loaded module "USER32.DLL" at base 751a0000 "165-018gx_.exe" loaded module "COMCTL32.DLL" at base 735a0000 "165-018gx_.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742d0000 "165-018gx_.exe" loaded module "RPCRT4.DLL" at base 74a30000 "165-018gx_.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 732c0000 "165-018gx_.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 776c0000 "165-018gx_.exe" loaded module "NTDLL.DLL" at base 77e00000 "165-018gx_.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d70000 "165-018gx_.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75320000 "165-018gx_.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73950000 "165-018gx_.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 759b0000 "165-018gx_.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74110000 "165-018gx_.exe" loaded module "MSISO.DLL" at base 738f0000 "165-018gx_.exe" loaded module "SSPICLI.DLL" at base 74820000 "165-018gx_.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77340000 "2f2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff853730000 "2f2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff853730000 "2f2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff853730000 "2f2.exe" loaded module "KERNEL32" at base 7ff854720000 "2f2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff834240000 "0jJETMG.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77340000 "0jJETMG.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77340000 "0jJETMG.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77340000 "0jJETMG.exe" loaded module "KERNEL32" at base 75320000 "0jJETMG.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b440000 "0jJETMG.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742d0000 "0jJETMG.exe" loaded module "KERNEL32.DLL" at base 75320000 "0jJETMG.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 6b3e0000 "0jJETMG.exe" loaded module "RPCRT4.DLL" at base 74a30000 "0jJETMG.exe" loaded module "SSPICLI.DLL" at base 74820000 "0jJETMG.exe" loaded module "WININET.DLL" at base 6b170000 "0jJETMG.exe" loaded module "MSCOREE.DLL" at base 6f780000 "0jJETMG.exe" loaded module "AMSI.DLL" at base 72280000 "0jJETMG.exe" loaded module "WINMM.DLL" at base 6b140000 "0jJETMG.exe" loaded module "USER32.DLL" at base 751a0000 "0jJETMG.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73ad0000 "0jJETMG.exe" loaded module "WSHTCPIP" at base 73ab0000 "0jJETMG.exe" loaded module "WSHIP6.DLL" at base 73aa0000 "0jJETMG.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 73ac0000 "0jJETMG.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6b10000032:T149d,"165-018gx_.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "165-018gx_.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "165-018gx_.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "165-018gx_.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "165-018gx_.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "165-018gx_.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "165-018gx_.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "165-018gx_.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "165-018gx_.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "165-018gx_.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "165-018gx_.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "165-018gx_.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "165-018gx_.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "165-018gx_.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "165-018gx_.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "165-018gx_.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "165-018gx_.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "165-018gx_.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "165-018gx_.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "165-018gx_.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "165-018gx_.exe" touched "HTML Application" (Path: "HKCU\WOW6432NODE\CLSID\{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "165-018gx_.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "165-018gx_.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "165-018gx_.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "165-018gx_.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "165-018gx_.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "165-018gx_.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "165-018gx_.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "165-018gx_.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "165-018gx_.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "0jJETMG.exe" touched "HNetCfg.FwPolicy2" (Path: "HKCU\WOW6432NODE\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}") "0jJETMG.exe" touched "HNetCfg.FwRule" (Path: "HKCU\WOW6432NODE\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}\TREATAS")33:Tef9,Process "mshta.exe" (UID: 00000000-00005496) was launched with new environment variables: "7zSfxFolder20="%WINDIR%\Fonts", 7zSfxFolder21="%APPDATA%\Microsoft\Windows\Templates", CommonDocuments="%PUBLIC%\Documents", MyDocs="%USERPROFILE%\Documents", UserDesktop="%USERPROFILE%\Desktop", 7zSfxFolder28="%USERPROFILE%\AppData\Local", 7zSfxFolder29="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder26="%USERPROFILE%\AppData\Roaming", 7zSfxFolder27="%APPDATA%\Microsoft\Windows\Printer Shortcuts", USERDNSDOMAIN="DESKTOP-FVVF82A", 7zSfxFolder24="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder25="%PUBLIC%\Desktop", 7zSfxFolder22="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu", 7zSfxFolder23="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs", 7zSfxFolder53="%PUBLIC%\Music", 7zSfxFolder54="%PUBLIC%\Pictures", 7zSfxFolder19="%APPDATA%\Microsoft\Windows\Network Shortcuts", 7zSfxFolder59="%LOCALAPPDATA%\Microsoft\Windows\Burn\Burn", 7zSfxFolder16="%USERPROFILE%\Desktop", 7zSfxFolder13="%USERPROFILE%\Music", 7zSfxFolder14="%USERPROFILE%\Videos", 7zSfxFolder11="%APPDATA%\Microsoft\Windows\Start Menu", 7zSfxFolder55="%PUBLIC%\Videos", 7zSfxFolder56="%WINDIR%\resources", 7zSfxFolder42="%PROGRAMFILES%\(x86)", 7zSfxFolder43="%PROGRAMFILES%\(x86)\Common Files", 7zSfxFolder40="C:\Users\%OSUSER%", 7zSfxFolder41="%WINDIR%\SysWOW64", 7zSfxFolder08="%APPDATA%\Microsoft\Windows\Recent", 7zSfxFolder09="%APPDATA%\Microsoft\Windows\SendTo", 7zSfxFolder06="%USERPROFILE%\Favorites", 7zSfxFolder07="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup", 7zSfxFolder48="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", 7zSfxFolder05="%USERPROFILE%\Documents", 7zSfxFolder02="%APPDATA%\Microsoft\Windows\Start Menu\Programs", 7zSfxFolder46="%PUBLIC%\Documents", 7zSfxFolder47="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Administrative Tools", 7zSfxFolder00="%USERPROFILE%\Desktop", 7zSfxFolder44="%PROGRAMFILES%\(x86)\Common Files", 7zSfxFolder45="%ALLUSERSPROFILE%\Microsoft\Windows\Templates", 7zSfxFolder31="%USERPROFILE%\Favorites", 7zSfxFolder32="%LOCALAPPDATA%\Microsoft\Windows\INetCache", 7zSfxFolder30="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup", MyDocuments="%USERPROFILE%\Documents", 7zSfxFolder39="%USERPROFILE%\Pictures", 7zSfxFolder37="%WINDIR%\system32", 7zSfxFolder38="%PROGRAMFILES%\(x86)", 7zSfxFolder35="C:\ProgramData", 7zSfxFolder36="C:\WINDOWS", CommonDesktop="%PUBLIC%\Desktop", 7zSfxFolder33="%LOCALAPPDATA%\Microsoft\Windows\INetCookies", 7zSfxFolder34="%LOCALAPPDATA%\Microsoft\Windows\History"" Process "mshta.exe" (UID: 00000000-00005496) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "2f2.exe" (UID: 00000000-00003276) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, PATHEXT, ProgramFiles, CommonProgramFiles, Path, NUMBER_OF_PROCESSORS" Process "2f2.exe" (UID: 00000000-00003276) was launched with missing environment variables: "7zSfxFolder20, 7zSfxFolder21, CommonDocuments, MyDocs, UserDesktop, 7zSfxFolder28, 7zSfxFolder29, 7zSfxFolder26, 7zSfxFolder27, 7zSfxFolder24, 7zSfxFolder25, 7zSfxFolder22, 7zSfxFolder23, 7zSfxFolder53, 7zSfxFolder54, PROCESSOR_ARCHITEW6432, 7zSfxFolder19, 7zSfxFolder59, 7zSfxFolder16, 7zSfxFolder13, 7zSfxFolder14, 7zSfxFolder11, 7zSfxFolder55, 7zSfxFolder56, 7zSfxFolder42, 7zSfxFolder43, 7zSfxFolder40, 7zSfxFolder41, PROMPT, 7zSfxFolder08, 7zSfxFolder09, 7zSfxFolder06, 7zSfxFolder07, 7zSfxFolder48, 7zSfxFolder05, 7zSfxFolder02, 7zSfxFolder46, 7zSfxFolder47, 7zSfxFolder00, 7zSfxFolder44, 7zSfxFolder45, 7zSfxFolder31, 7zSfxFolder32, 7zSfxFolder30, MyDocuments, 7zSfxFolder39, 7zSfxFolder37, 7zSfxFolder38, 7zSfxFolder35, 7zSfxFolder36, CommonDesktop, 7zSfxFolder33, 7zSfxFolder34"34:Ta12,"165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")35:Te95,"165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")36:T6a5,"165-018gx_.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "165-018gx_.exe" trying to access non-existent file "C:\FLTLIB.DLL" "165-018gx_.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "165-018gx_.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "165-018gx_.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "165-018gx_.exe" trying to access non-existent file "C:\PROPSYS.DLL" "165-018gx_.exe" trying to access non-existent file "C:\PROPSYS.dll" "165-018gx_.exe" trying to access non-existent file "C:\CLDAPI.DLL" "165-018gx_.exe" trying to access non-existent file "C:\CLDAPI.dll" "165-018gx_.exe" trying to access non-existent file "C:\AEPIC.DLL" "165-018gx_.exe" trying to access non-existent file "C:\AEPIC.dll" "165-018gx_.exe" trying to access non-existent file "C:\BCRYPT.DLL" "165-018gx_.exe" trying to access non-existent file "C:\bcrypt.dll" "165-018gx_.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "165-018gx_.exe" trying to access non-existent file "C:\edputil.dll" "165-018gx_.exe" trying to access non-existent file "C:\URLMON.DLL" "165-018gx_.exe" trying to access non-existent file "C:\urlmon.dll" "165-018gx_.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "165-018gx_.exe" trying to access non-existent file "C:\iertutil.dll" "2f2.exe" trying to access non-existent file "C:\Users\Public\wh9A4p\FLTLIB.DLL" "2f2.exe" trying to access non-existent file "C:\Users\Public\wh9A4p\CRYPTSP.DLL" "0jJETMG.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\MSI.DLL"37:T84c,"165-018gx_.exe" trying to access non-existent file "C:\165-018GX_.EXE.LOCAL" "165-018gx_.exe" trying to access non-existent file "C:\165-018gx_.exe.Local\" "165-018gx_.exe" trying to access non-existent file "C:\Windows\Resources\0409" "165-018gx_.exe" trying to access non-existent file "C:\WINDOWS\resources\0409" "165-018gx_.exe" trying to access non-existent file "C:\ProgramData\OEM LINKS" "165-018gx_.exe" trying to access non-existent file "C:\ProgramData\OEM Links" "165-018gx_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SETUP.HTA" "165-018gx_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\setup.hta" "165-018gx_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\setup.hta:ZONE.IDENTIFIER" "165-018gx_.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\setup.hta:Zone.Identifier" "2f2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WOBISLE_MJ2RBA.LNK" "2f2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Wobisle_Mj2rbA.lnk" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\0JJETMG.EXE.LOCAL" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\WINSPOOL.DRV" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\KIT\Log\20260301023610\UTILITY.LOG4CPLUS0" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\KIT\Log\20260301023610\KITSERVICE.LOG4CPLUS0" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\KIT\Log\20260301023610\KITService.log4cplus0" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\1.TXT" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\1.txt" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\2.TXT" "0jJETMG.exe" trying to access non-existent file "C:\ProgramData\tYw3t9K7\2.txt" "0jJETMG.exe" trying to access non-existent file "\Device\RasAcd"38:T618,Found reference to API "Attach SOCKET to IOCP Fail" (Indicator: " socket "; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API "Listen SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API "Prepare SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API "Bind SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp") Found reference to API "Create SOCKET Fail" (Indicator: " socket "; Source: "00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp")39:Ted0,Found string "file #%lu: bad zipfile offset (%s): %ld" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "error: cannot open zipfile [ %s ]" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "error: zipfile read error" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "error: zipfile probably corrupt (%s)" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "%d file%s had no zipfile directory." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "1 "zipfile" was a directory." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "%d "zipfiles" were directories." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "No zipfiles found." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "%s: cannot find zipfile directory in %s," (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "Zipfile is disk %lu of a multi-disk archive, and this is not the disk on" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "which the central zipfile directory begins (disk %lu)." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "warning [%s]: zipfile claims to be last disk of a multi-part archive;" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "warning [%s]: %s extra byte%s at beginning or within zipfile" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "error [%s]: missing %s bytes in zipfile" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "warning [%s]: zipfile is empty" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "zipfile corrupt." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "This zipfile is corrupt." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "%s bytes too long (Atari STZip zipfile? J.H.Holm ZIPSPLIT 1.1" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "zipfile?). Compensating..." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "a zipfile, or it constitutes one disk of a multi-part archive. In the" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "latter case the central directory and zipfile comment will be found on" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "caution: zipfile comment truncated" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "There is no zipfile comment." (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "The zipfile comment is %u bytes long and contains the following text:" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "======================== zipfile comment begins ==========================" (Indicator: "zipfile"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp")3a:T93f,Found reference to API "GetDC" (Indicator: "GetDC"; File: "165-018gx.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp")3b:Te51,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "100,7060,3121,,CreateToolhelp32Snapshot,ke" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp") Found reference to API "10854959277,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10860134873,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10857908053,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10856669790,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10845218014,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10858417823,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10859621827,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10850538230,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10852261832,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10855668753,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10859135137,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10832819216,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.968",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10840558220,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.984",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp") Found reference to API "10818477042,6020,3125,,Process32NextW,kernel32.dll,"00:50:59.968",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00007924.00000000.195853.009A0000.00000004.mdmp")3c:T5b8,Found string "skipping: %-22s unable to get password" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "skipping: %-22s incorrect password" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "%lu file%s skipped because of incorrect password." (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "(may instead be incorrect password)" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "[%s] %s password:" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "Enter password:" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "password incorrect--reenter:" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "funzip [-password] [input[.zip|.gz]]" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "-P p Use password p to decrypt files. THIS IS INSECURE! Some OS show" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found string "error: must give decryption password with -P option" (Indicator: "password"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp")3d:T60e,Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "IsValidAcl" (Indicator: "IsValidAcl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp")3e:Taa4,"165-018gx_.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\MSHTA.EXE"; Value: "") "2f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "0jJETMG.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")3f:T713,"165-018gx_.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C60B000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83004B000000A19F5E000400010000006C00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000090000001A9CB2000100050000000100000016F0B20001006500000034050000E6C5310000") "165-018gx_.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "165-018gx_.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "165-018gx_.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "165-018gx_.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "165-018gx_.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\WINDOWS\SYSWOW64\MSHTA.EXE.FRIENDLYAPPNAME"; Value: "Microsoft (R) HTML Application host"), "165-018gx_.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\WINDOWS\SYSWOW64\MSHTA.EXE.APPLICATIONCOMPANY"; Value: "Microsoft Corporation"), "0jJETMG.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "0jJETMG.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "@C:\WINDOWS\SYSWOW64\FIREWALLCONTROLPANEL.DLL -12122"; Value: "Windows Defender Firewall")40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAIiP/4hwAAAAAAAAAAAAAHiIj///iAAAAAAAAAAAAAiIiI////+HAAAAAAAAAACIiIiP////iAAAAAAAAAAAiIiIj///+IhwAAAAAAAACIiIiId4/4iIhwAAAAAAAAiIiIeIiHiIiIcAAAAAAACIiIh4h3iHiIiIAAAAd3d3iIiIeHeIh4iIiAAAAAAACIiIiHiAAHh4iIgAAAAAAAiIiIh4gACIiIiIAAAAAAAIeIiIeId4h4iIiAAIiIiIh3iI/4eP+HiIiIcAd2ZmZmZo///4d3eIiIiHAHZmZmZmZ/////+IiIiIgAB2ZmZmZmaP////iIiIiAAAdmZmZmZmaP///4iIiIAAAHZmZmZmZmaP//+IiIgAAAB3h2ZmZmZmZoj/iIiAAAAAd4iIdmZmZmZmd3ZnAAAAAHd3iIiGZmZmZmZmZgAAAAB3d3eIiIZmZmZmZmYAAAAAdnd3eIiIhmZmZmZmAAAAAHZ3d3d4iIh2ZmZmZgAAAAB2Znd3d3iIiHZmZmYAAAAAdmZmd3d3d4iHZmZmAAAAAHZmZmZ3d3d3d4dmZgAAAAB2ZmZmZ3d3d3iIdmYAAAAAdmZmZmZmd3d3d3dgAAAAAHd3d3d3d3d3d3d3BwAAAAD////////n////AH///AA///gAD//wAA//8AAH/+AAA//gAAP/wAAD8AAAA/+AHAP/gBwD/4AAA4AAAAMAAAADAAAABwAAAA8AAAAfAAAAPwAAAH8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/w==41:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAIiP/4hwAAAAAAAAAAAAAHiIj///iAAAAAAAAAAAAAiIiI////+HAAAAAAAAAACIiIiP////iAAAAAAAAAAAiIiIj///+IhwAAAAAAAACIiIiId4/4iIhwAAAAAAAAiIiIeIiHiIiIcAAAAAAACIiIh4h3iHiIiIAAAAd3d3iIiIeHeIh4iIiAAAAAAACIiIiHiAAHh4iIgAAAAAAAiIiIh4gACIiIiIAAAAAAAIeIiIeId4h4iIiAAIiIiIh3iI/4eP+HiIiIcAd2ZmZmZo///4d3eIiIiHAHZmZmZmZ/////+IiIiIgAB2ZmZmZmaP////iIiIiAAAdmZmZmZmaP///4iIiIAAAHZmZmZmZmaP//+IiIgAAAB3h2ZmZmZmZoj/iIiAAAAAd4iIdmZmZmZmd3ZnAAAAAHd3iIiGZmZmZmZmZgAAAAB3d3eIiIZmZmZmZmYAAAAAdnd3eIiIhmZmZmZmAAAAAHZ3d3d4iIh2ZmZmZgAAAAB2Znd3d3iIiHZmZmYAAAAAdmZmd3d3d4iHZmZmAAAAAHZmZmZ3d3d3d4dmZgAAAAB2ZmZmZ3d3d3iIdmYAAAAAdmZmZmZmd3d3d3dgAAAAAHd3d3d3d3d3d3d3BwAAAAD////////n////AH///AA///gAD//wAA//8AAH/+AAA//gAAP/wAAD8AAAA/+AHAP/gBwD/4AAA4AAAAMAAAADAAAABwAAAA8AAAAfAAAAPwAAAH8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/w==42:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAIiP/4hwAAAAAAAAAAAAAHiIj///iAAAAAAAAAAAAAiIiI////+HAAAAAAAAAACIiIiP////iAAAAAAAAAAAiIiIj///+IhwAAAAAAAACIiIiId4/4iIhwAAAAAAAAiIiIeIiHiIiIcAAAAAAACIiIh4h3iHiIiIAAAAd3d3iIiIeHeIh4iIiAAAAAAACIiIiHiAAHh4iIgAAAAAAAiIiIh4gACIiIiIAAAAAAAIeIiIeId4h4iIiAAIiIiIh3iI/4eP+HiIiIcAd2ZmZmZo///4d3eIiIiHAHZmZmZmZ/////+IiIiIgAB2ZmZmZmaP////iIiIiAAAdmZmZmZmaP///4iIiIAAAHZmZmZmZmaP//+IiIgAAAB3h2ZmZmZmZoj/iIiAAAAAd4iIdmZmZmZmd3ZnAAAAAHd3iIiGZmZmZmZmZgAAAAB3d3eIiIZmZmZmZmYAAAAAdnd3eIiIhmZmZmZmAAAAAHZ3d3d4iIh2ZmZmZgAAAAB2Znd3d3iIiHZmZmYAAAAAdmZmd3d3d4iHZmZmAAAAAHZmZmZ3d3d3d4dmZgAAAAB2ZmZmZ3d3d3iIdmYAAAAAdmZmZmZmd3d3d3dgAAAAAHd3d3d3d3d3d3d3BwAAAAD////////n////AH///AA///gAD//wAA//8AAH/+AAA//gAAP/wAAD8AAAA/+AHAP/gBwD/4AAA4AAAAMAAAADAAAABwAAAA8AAAAfAAAAPwAAAH8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"30577961b8385513744ff7dadade82b2a63f8fb2f4355dfa7ff13a067119d281","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791329371929,"unified_at":"2026-10-06T23:29:31.929Z","metadata":{"hashes":{"sha256":"30577961b8385513744ff7dadade82b2a63f8fb2f4355dfa7ff13a067119d281","sha1":"ccf2cdec7ac1e602b424c9c73c262e3d4e115086","md5":"d197c687159d564efb78db9c4fb4d29b","sha512":"c0f666ec085e8d9918c1187478d07b97626ac68c3f71379b440403831f3613e2c54c3d39924bdedf7e52dbf23d429167c7623851f14366004b398b2e3971e399","ssdeep":"98304:vcKxvQv/wuMiNwjDc/cpeMJAwsSInZ48EQNCekd:mGYXws/a","ssdeep_chunks":["98304:vcKxvQv","98304:cKxvQv/","98304:KxvQv/w","98304:xvQv/wu","98304:vQv/wuM","98304:Qv/wuMi","98304:v/wuMiN","98304:/wuMiNw","98304:wuMiNwj","98304:uMiNwjD","98304:MiNwjDc","98304:iNwjDc/","98304:NwjDc/c","98304:wjDc/cp","98304:jDc/cpe","98304:Dc/cpeM","98304:c/cpeMJ","98304:/cpeMJA","98304:cpeMJAw","98304:peMJAws","98304:eMJAwsS","98304:MJAwsSI","98304:JAwsSIn","98304:AwsSInZ","98304:wsSInZ4","98304:sSInZ48","98304:SInZ48E","98304:InZ48EQ","98304:nZ48EQN","98304:Z48EQNC","98304:48EQNCe","98304:8EQNCek","98304:EQNCekd","196608:vcKxvQv","196608:cKxvQv/","196608:KxvQv/w","196608:xvQv/wu","196608:vQv/wuM","196608:Qv/wuMi","196608:v/wuMiN","196608:/wuMiNw","196608:wuMiNwj","196608:uMiNwjD","196608:MiNwjDc","196608:iNwjDc/","196608:NwjDc/c","196608:wjDc/cp","196608:jDc/cpe","196608:Dc/cpeM","196608:c/cpeMJ","196608:/cpeMJA","196608:cpeMJAw","196608:peMJAws","196608:eMJAwsS","196608:MJAwsSI","196608:JAwsSIn","196608:AwsSInZ","196608:wsSInZ4","196608:sSInZ48","196608:SInZ48E","196608:InZ48EQ","196608:nZ48EQN","196608:Z48EQNC","196608:48EQNCe","196608:8EQNCek","196608:EQNCekd","98304:mGYXws/","98304:GYXws/a"],"imphash":"b484b52df60e8d823b647a09bb1e39f9"},"file_info":{"file_name":"165-018gx安装.exe","file_type":["peexe","executable","compressed","sfx","7zip"],"file_type_id":"exe 7zip sfx","file_size":3440096,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1772332529000,"last_seen":1772335327000,"last_multi_scan":1772335327000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["startpage"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":141,"suspicious_count":17,"malicious_count":5,"total":163},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Generic-9867923-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce6441 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_56.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Found Base64 decoding crypto library string in memory"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Mshta","attack_id":"T1218.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/005","identifiers":[{"type":"malicious","value":"Detected mshta.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","identifiers":[{"type":"suspicious","value":"Drops compressed file on the system"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PKZIP contains cleartext script"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"Found Base64 encoding crypto library string in memory"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer files using SCP"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"suspicious","value":"Opens many files with write access (often indicator for full-system infection)"}],"sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"_VirtualAllocFree(}\" (Indicator: \"VirtualAlloc\"; File: \"165-018gx.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"165-018gx.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"165-018gx.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"165-018gx.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$25","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"warning: SetFileTime() for %s error %d\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"SetFileTime failed: %d\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found Base64 decoding crypto library string in memory","description":"Found Base64 decoder \"AVBase64Decoder@CryptoPP@@\" - Source: \"00000000-00007924.00000001.197774.6BCC5000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1140","relevance":2,"id":"memorydump-12","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found Base64 encoding crypto library string in memory","description":"Found Base64 encoder \"AVBase64Encoder@CryptoPP@@\" - Source: \"00000000-00007924.00000001.197774.6BCC5000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1132.001","relevance":2,"id":"memorydump-11","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007924.00000000.195853.070C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007924.00000001.197774.07211000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$26","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"0jJETMG.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99793","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found Base64 encoding crypto library string in memory\n Matched sigs: Found Base64 decoding crypto library string in memory\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - Compress data using CryptoPP library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000968-00000C2C-2015859774\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007924-00000C2C-2029908415\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00000968-00000C2C-2016010607\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"2f2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003276)\n \"0jJETMG.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"2f2.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003276)\n \"2f2.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003276)\n \"0jJETMG.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"165-018gx_.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"165-018gx_.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"0jJETMG.exe\" called \"IsWow64Process\" with parameter \"7924\" - (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"165-018gx_.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"2f2.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003276)\n \"2f2.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003276)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"165-018gx_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"165-018gx_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"2f2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"2f2.exe\" queries volume information of \"C:\\\" at 00000000-00003276-00000C17-2022318861","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"2f2.exe\" queries volume information of \"C:\\\" at 00000000-00003276-00000C17-2022318861","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"165-018gx_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"165-018gx_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP.HTA\")\n \"165-018gx_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSHTA.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"0jJETMG.exe\" called \"CopyFileA\" to copy %ALLUSERSPROFILE%\\tYw3t9K7\\0jJETMG.exe to new location %LOCALAPPDATA%\\0jJETMG.exe (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"165-018gx_.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00000968)\n \"0jJETMG.exe\" called \"CreateDirectoryA\" with parameter 433a (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"CreateDirectoryA\" with parameter C:\\ProgramData (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\KIT (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\KIT\\Log (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\KIT\\Log\\20260301023610 (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"165-018gx_.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\SysWOW64\\mshta.exe\" \"%TEMP%\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1\" - (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"143.92.60.5:1527\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"REGEDIT: CreateFile failed, GetLastError() = %d\" (Indicator: \"GetLastError\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"165-018gx_.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00000968)\n \"0jJETMG.exe\" with parameter 433a (UID: 00000000-00007924)\n \"0jJETMG.exe\" with parameter C:\\ProgramData (UID: 00000000-00007924)\n \"0jJETMG.exe\" with parameter %ALLUSERSPROFILE%\\KIT (UID: 00000000-00007924)\n \"0jJETMG.exe\" with parameter %ALLUSERSPROFILE%\\KIT\\Log (UID: 00000000-00007924)\n \"0jJETMG.exe\" with parameter %ALLUSERSPROFILE%\\KIT\\Log\\20260301023610 (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2f","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"setup.hta\" as clean (type is \"Zip archive data at least v2.0 to extract compression method=store\")\n Antivirus vendors marked dropped file \"0jJETMG.exe\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"), Antivirus vendors marked dropped file \"Wobisle_Mj2rbA.lnk\" as clean (type is \"MS Windows shortcut Item id list present Has Relative path Has Working directory Unicoded length=0 window=showminnoactive IDListSize 0x014d Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\"\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"0jJETMG.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"mshta.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6DA60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"mshta.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72280000\n \"0jJETMG.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72280000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"165-018gx_.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75870000\n \"165-018gx_.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BA0000\n \"mshta.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75870000\n \"mshta.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BA0000\n \"2f2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 53CA0000\n \"0jJETMG.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75870000\n \"0jJETMG.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73BA0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"mshta.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 6EF40000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"165-018gx_.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A30000\n \"mshta.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A30000\n \"2f2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 55E20000\n \"0jJETMG.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"165-018gx.exe\" was detected as \"7-Zip\" and name: \"Installer\"\n \"165-018gx.exe\" was detected as \"UPX\" and name: \"Packer\"\n \"165-018gx.exe\" was detected as \"7-Zip\" and name: \"Archive\"\n \"165-018gx.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"0jJETMG.exe\" was detected as \"7-Zip\" and name: \"Installer\"\n \"0jJETMG.exe\" was detected as \"UPX\" and name: \"Packer\"\n \"0jJETMG.exe\" was detected as \"7-Zip\" and name: \"Archive\"\n \"0jJETMG.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$32","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\mshta.exe.FriendlyAppName\" [Source: 00000000-00000968-00000BC1-2017252802]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\mshta.exe.ApplicationCompany\" [Source: 00000000-00000968-00000BC1-2017253151]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\mshta.exe\" [Source: 00000000-00000968-00000C47-4178202276]\n Observed system executable string:\"\"%WINDIR%\\SysWOW64\\mshta.exe\" \"%TEMP%\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1\" [Source: 00000000-00000968-00000C47-4178202276]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"slong.help\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"165-018gx_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"165-018gx_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"165-018gx_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"2f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"2f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"2f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"@%WINDIR%\\SysWOW64\\FirewallControlPanel.dll,-12122\" [Source: 00000000-00007924-00000BC1-2028759225]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mshta.exe\" with commandline \"\"%TEMP%\\\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460 ...\" (UID: 00000000-00005496)\n Spawned process \"2f2.exe\" with commandline \"\"%APPDATA%\\\\RaR.zip\" (UID: 00000000-00003276), Spawned process \"0jJETMG.exe\" (UID: 00000000-00007924)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"mshta.exe\" with commandline \"\"%TEMP%\\\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460 ...\" (UID: 00000000-00005496)\n Spawned process \"2f2.exe\" with commandline \"\"%APPDATA%\\\\RaR.zip\" (UID: 00000000-00003276), Spawned process \"0jJETMG.exe\" (UID: 00000000-00007924)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 2896257)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"165-018gx.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"0jJETMG.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"165-018gx_.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\setup.hta\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"165-018gx.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"165-018gx_.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"0jJETMG.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"setup.hta\" has type \"Zip archive data at least v2.0 to extract compression method=store\"- Location: [%TEMP%\\setup.hta]- [targetUID: 00000000-00000968]\n \"0jJETMG.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%LOCALAPPDATA%\\0jJETMG.exe]- [targetUID: 00000000-00007924]\n \"Wobisle_Mj2rbA.lnk\" has type \"MS Windows shortcut Item id list present Has Relative path Has Working directory Unicoded length=0 window=showminnoactive IDListSize 0x014d Root folder \"20D04FE0-3AEA-1069-A2D8-08002B30309D\" Volume \"C:\\\"\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Wobisle_Mj2rbA.lnk]- [targetUID: 00000000-00003276]\n \"KITService.log4cplus0\" has type \"ISO-8859 text\"- Location: [%ALLUSERSPROFILE%\\KIT\\Log\\20260301023610\\KITService.log4cplus0]- [targetUID: 00000000-00007924]\n \"Utility.log4cplus0\" has type \"ISO-8859 text\"- Location: [%ALLUSERSPROFILE%\\KIT\\Log\\20260301023610\\Utility.log4cplus0]- [targetUID: 00000000-00007924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"165-018gx_.exe\" queries basic process information of the \"C:\\165-018gx_.exe\" (UID: 968)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"165-018gx_.exe\" reads file \"c:\\165-018gx_.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"165-018gx_.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\165-018gx_.exe\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\user32.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \"165-018gx_.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"165-018gx_.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"165-018gx_.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"2f2.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Wobisle_Mj2rbA.lnk\"\n \"2f2.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Wobisle_Mj2rbA.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"2f2.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WOBISLE_MJ2RBA.LNK\"\n \"2f2.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Wobisle_Mj2rbA.lnk\"\n \"2f2.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WOBISLE_MJ2RBA.LNK\"\n \"2f2.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Wobisle_Mj2rbA.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"165-018gx_.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\setup.hta\"\n \"165-018gx_.exe\" writes file \"%temp%\\setup.hta\"\n \"2f2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wobisle_mj2rba.lnk\"\n \"2f2.exe\" writes file \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\wobisle_mj2rba.lnk\"\n \"0jJETMG.exe\" writes file \"c:\\programdata\\kit\\log\\20260301023610\\utility.log4cplus0\"\n \"0jJETMG.exe\" writes file \"c:\\programdata\\kit\\log\\20260301023610\\utility.log0\"\n \"0jJETMG.exe\" writes file \"c:\\programdata\\kit\\log\\20260301023610\\kitservice.log4cplus0\"\n \"0jJETMG.exe\" writes file \"c:\\programdata\\kit\\log\\20260301023610\\kitservicelog.log0\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"0jJETMG.exe\" writes a file \"C:\\ProgramData\\KIT\\Log\\20260301023610\\Utility.log4cplus0\"\n \"0jJETMG.exe\" writes a file \"C:\\ProgramData\\KIT\\Log\\20260301023610\\Utility.log0\"\n \"0jJETMG.exe\" writes a file \"C:\\ProgramData\\KIT\\Log\\20260301023610\\KITService.log4cplus0\"\n \"0jJETMG.exe\" writes a file \"C:\\ProgramData\\KIT\\Log\\20260301023610\\KITServiceLog.log0\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"Observed string: \"SCp\" (Indicator: \"scp\") in Source: 00000000-00007924.00000000.195853.048F0000.00000004.mdmp\n 00000000-00007924.00000000.195853.068EA000.00000004.mdmp\n 00000000-00007924.00000001.197774.048F0000.00000004.mdmp\n 00000000-00007924.00000001.197774.0671F000.00000004.mdmp\n 00000000-00007924.00000002.199693.048F0000.00000004.mdmp\n 00000000-00007924.00000002.199693.050BF000.00000004.mdmp\n Observed string: \"SCp :\" (Indicator: \"scp \") in Source: 00000000-00007924.00000000.195853.068EA000.00000004.mdmp\n 00000000-00007924.00000001.197774.0671F000.00000004.mdmp\n 00000000-00007924.00000002.199693.050BF000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"143.92.60.5\"\n Potential IP \"0.6.1.35\" found in string \":0.6.1.35,\"\n \"0.6.1.35\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"hm.il\"\n Heuristic match: \"ot.ni\"\n Heuristic match: \"v1.am\"\n Heuristic match: \"nv>.ie\"\n Heuristic match: \"nc.ee\"\n Heuristic match: \"tjb!zd|xix.mo\"\n Heuristic match: \"x$h.id\"\n Heuristic match: \"easy 7z setup sfx @ skyun.org\"\n Pattern match: \"http://www.info-zip.org/zip-bug.html\"\n Pattern match: \"ftp.info-zip.org/pub/infozip/\"\n Pattern match: \"ftp.info-zip.org/pub/infozip/unzip.html\"\n Heuristic match: \":/programdata/tyw3t9k7/longlq.cl\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"c:/programdata/tyw3t9k7/longlq.cl\"\n Heuristic match: \"9=<.ye\"\n Heuristic match: \"z6xw_.tl\"\n Heuristic match: \"r;#2.bm\"\n Heuristic match: \"'{y.cn\"\n Heuristic match: \"d3.cv\"\n Heuristic match: \"ht.gp\"\n Heuristic match: \"}#.aw\"\n Heuristic match: \"lu.gg\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.info-zip.org/zip-bug.html;\" - Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found URL \"ftp://ftp.info-zip.org/pub/infozip/\" - Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found URL \"ftp://ftp.info-zip.org/pub/infozip/unzip.html\" - Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007924.00000000.195853.009A0000.00000004.mdmp\")\n Found URL \"https://http://%s\" - Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp\")\n Found URL \"https://http://%s\" - Source: \"00000000-00007924.00000000.195853.070C0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00007924.00000001.197774.009A0000.00000004.mdmp\")\n Found URL \"https://http://%s\" - Source: \"00000000-00007924.00000001.197774.07211000.00000002.mdmp\")\n Found URL \"https://http://%s\" - Source: \"00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00007924\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00007924\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"165-018gx_.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"165-018gx_.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"2f2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"0jJETMG.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"0jJETMG.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"0jJETMG.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"0jJETMG.exe\" called \"GetUserNameA\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"165-018gx.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"REG QUERY /?\" (Indicator: \"reg query\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")\n Found string \"REG QUERY HKLM\\Software\\Microsoft\\ResKit /v Version\" (Indicator: \"reg query\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")\n Found string \"REG QUERY HKLM\\Software\\Microsoft\\ResKit\\Nt\\Setup /s\" (Indicator: \"reg query\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"0jJETMG.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Users\\Public\\wh9A4p\\2f2.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003276.00000000.195434.02B20000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000001.197774.009A0000.00000004.mdmp, 00000000-00007924.00000002.199693.009A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007924.00000000.195853.009A0000.00000004.mdmp, 00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")\n Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"165-018gx.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"0jJETMG.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"165-018gx_.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003276.00000000.195434.0E0EA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"0jJETMG.exe\" - Location: [%LOCALAPPDATA%\\0jJETMG.exe]- [targetUID: 00000000-00007924]\n Dropped file: \"Wobisle_Mj2rbA.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Wobisle_Mj2rbA.lnk]- [targetUID: 00000000-00003276]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetStdHandle\" (Source: 165-018gx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"LoadLibraryA\" (Source: 165-018gx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcAddress\" (Source: 165-018gx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"VirtualProtect\" (Source: 165-018gx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"VirtualAlloc\" (Source: 165-018gx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"VirtualFree\" (Source: 165-018gx.exe, API is part of module: KERNELBASE.DLL)\n Found string \"ExitProcess\" (Source: 165-018gx.exe, API is part of module: KERNEL32.DLL)\n Found string \"DeleteDC\" (Source: 165-018gx.exe, API is part of module: GDI32.DLL)\n Found string \"CoInitialize\" (Source: 165-018gx.exe, API is part of module: OLE32.DLL)\n Found string \"SHGetMalloc\" (Source: 165-018gx.exe, API is part of module: SHELL32.DLL)\n Found string \"GetDC\" (Source: 165-018gx.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"165-018gx_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"2f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"0jJETMG.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"165-018gx_.exe\" at 00000000-00000968-00000C15-2017079161","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\mshta.exe\" launched with commandline \"\"%TEMP%\\\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}\" (UID: 00000000-00005496)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\setup.hta\" has high entropy 7.83535","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops compressed file on the system","description":"\"setup.hta\" has type \"Zip archive data at least v2.0 to extract compression method=store\"","origin":"Binary File","mitre_attack_id":"T1027.015","relevance":1,"id":"binary-84","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"0jJETMG.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"slong.help\"\n \"pHints\": \"6fd4e8c\"\n \"ppResult\": \"00000000b84efd06\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"2f2.exe\" called \"FileTimeToLocalFileTime\" with parameter e22d6f3467a9dc01 & e2ed4b2624a9dc01 (UID: 00000000-00003276)\n \"2f2.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003276)\n \"2f2.exe\" called \"FileTimeToLocalFileTime\" with parameter 00696a3467a9dc01 & 0029472624a9dc01 (UID: 00000000-00003276)\n \"2f2.exe\" called \"FileTimeToLocalFileTime\" with parameter ad13f12c2eb7da01 & add3cd1eebb6da01 (UID: 00000000-00003276)\n \"2f2.exe\" called \"FileTimeToLocalFileTime\" with parameter 43d642bc65b4d301 & 43961fae22b4d301 (UID: 00000000-00003276)\n \"2f2.exe\" called \"FileTimeToLocalFileTime\" with parameter 877195f730b5d301 & 873172e9edb4d301 (UID: 00000000-00003276)\n \"2f2.exe\" called \"FileTimeToLocalFileTime\" with parameter 11068b6629b5d301 & 11c66758e6b4d301 (UID: 00000000-00003276)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"0jJETMG.exe\" (Thread ID: 6928) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"165-018gx_.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"165-018gx_.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"0jJETMG.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections\"- Location: [%LOCALAPPDATA%\\0jJETMG.exe]- [targetUID: 00000000-00007924]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"0jJETMG.exe\" wrote 58920 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\0jJETMG.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%ALLUSERSPROFILE%\\tYw3t9K7\\0jJETMG.exe\" connects to 143.92.60.5 on port 1527 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"Found string \"cmd=%d, BufferSize=%d\" (Indicator: \"cmd=\"; Source: \"00000000-00007924.00000000.195853.06D80000.00000004.mdmp, 00000000-00007924.00000000.195853.070C0000.00000004.mdmp, 00000000-00007924.00000001.197774.07211000.00000002.mdmp, 00000000-00007924.00000001.197774.076F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"0jJETMG.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00007924)\n \"0jJETMG.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00007924)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"165-018gx_.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"0jJETMG.exe\" opens more than 500 files with write access","origin":"API Call","mitre_attack_id":"T1491.001","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%ALLUSERSPROFILE%\\tYw3t9K7\\0jJETMG.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"165-018gx_.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\SysWOW64\\mshta.exe\" \"%TEMP%\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1\" - (UID: 00000000-00000968)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected mshta.exe process execution","description":"Process \"mshta.exe\" with commandline \"\"%TEMP%\\\\setup.hta\" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}\" (UID: 00000000-00005496)","origin":"Monitored Target","mitre_attack_id":"T1218.005","relevance":10,"id":"target-113","sources":[{"report_type":"sandbox","report_id":"69a3a5f0950ce71e7109c6a9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PKZIP contains cleartext script","description":"Found an embedded script in \"PKZIP\" file \"setup.hta\" at offset 3057270: b'