26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 75:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.FCA.Generic Sample 31dd07a9e3c8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 31dd07a9e3c8…. Malware family: Application.FCA.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 11 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/31dd07a9e3c84d5d139e41bba7a39fe449de128bdf7498062fb3d21f3d121fb5","keywords":["Malicious","Application.FCA.Generic","malware analysis","sandbox report","threat intelligence","31dd07a9e3c84d5d139e41bba7a39fe449de128bdf7498062fb3d21f3d121fb5"],"about":{"@type":"SoftwareApplication","name":"dreamywarev3.exe","applicationCategory":["peexe","executable"],"identifier":"31dd07a9e3c84d5d139e41bba7a39fe449de128bdf7498062fb3d21f3d121fb5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.FCA.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T432,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp, 00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp, 00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp, 00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp, 00000000-00006748.00000001.180392.24E90000.00000004.mdmp")28:Taa3,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp")29:T45b,Found reference string "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "%S Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; Source: "00000000-00005132.00000001.181025.006AD000.00000004.mdmp") Found reference string "C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp, 00000000-00006748.00000001.180392.0AB00000.00000004.mdmp") Found reference string "HostApplication=C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (Indicator: "add-mppreference"; Source: "00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp, 00000000-00006748.00000001.180392.24F17000.00000004.mdmp")2a:Teb3,Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp")2b:Teaa,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")2c:Tbe7,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")2d:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp")2e:T96c,"9iqmgvw,czc2.5.29.1bhv*8tpathawte," - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0erissq8" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fanonymously" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsy&" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006748.00000000.180124.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006748.00000000.180124.26860000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006748.00000000.180124.26860000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006748.00000000.180124.26860000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?" - Source: "00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc*dpczmicrosoft" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eriss2.5.29.102.5.4.3xc\*" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006748.00000001.180392.24E90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006748.00000001.180392.24F17000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportn" - Source: "00000000-00006748.00000001.180392.26887000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.120170929063406.466z0washington1redmond11%0" - Source: "00000000-00006748.00000001.180392.26887000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/06-2$vkt7" - Source: "00000000-00006748.00000001.180392.26887000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0jgg857a" - Source: "00000000-00006748.00000001.180392.26887000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006748.00000001.180392.26960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" (Indicator: "GetDC"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp")61:T6ea,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp")62:Te2e,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp")63:Tcd4,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")64:T43f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")65:T99b,Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp")66:T834,Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")67:T762,Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp")68:T4c6,Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005132-00000C2C-1810387963") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006748-00000C2C-1775665960") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00006748-00000C2C-1777693432") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00006748-00000C2C-1777694067") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp")69:Td32,Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00000752.00000000.183004.B8840000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001780.00000000.178999.06D80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00003620.00000000.181377.10130000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00003656.00000000.183130.D81A0000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00003732.00000000.182675.0DBA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004236.00000000.184103.5C6C0000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004324.00000000.182025.F96A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004480.00000000.181053.C2350000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004560.00000000.184427.7DD80000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004612.00000000.183001.42790000.00000004.mdmp, 00000000-00004612.00000001.184436.42790000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004968.00000000.183455.31870000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\dreamywarev3.exe" (Indicator: "\Device\"; Source: "00000000-00005132.00000001.181025.E5560000.00000004.mdmp, 00000000-00005132.00000002.182689.E5560000.00000004.mdmp") Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00006064.00000000.183779.381B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp, 00000000-00006748.00000001.180392.0AB00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006748.00000000.180124.0AB00000.00000004.mdmp, 00000000-00006748.00000001.180392.0AB2D000.00000004.mdmp")6a:Tbac,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")6b:T47a,Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003656.00000000.183130.D8430000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004560.00000000.184427.7E120000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004612.00000000.183001.428C0000.00000040.mdmp, 00000000-00004612.00000001.184436.40560000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005132.00000002.182689.E5500000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00006748.00000000.180124.45462000.00000002.mdmp, 00000000-00006748.00000001.180392.E6FEA000.00000002.mdmp")6c:T9f5,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001780.00000000.178999.06D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006748-00000BC0-1776443653\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006748.00000000.180124.24E90000.00000004.mdmp, 00000000-00006748.00000001.180392.24E90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006748.00000000.180124.24E90000.00000004.mdmp\n 00000000-00006748.00000001.180392.24E90000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003656.00000000.183130.D8430000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003732.00000000.182675.0DAF0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004236.00000000.184103.5C7C0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004560.00000000.184427.7E120000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004612.00000000.183001.428C0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004612.00000001.184436.40560000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005132.00000002.182689.E5500000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2f","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"31dd07a9e3c84d5d139e41bba7a39fe449de128bdf7498062fb3d21f3d121fb5.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"31dd07a9e3c84d5d139e41bba7a39fe449de128bdf7498062fb3d21f3d121fb5.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003732.00000000.182675.0DBA0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006748.00000001.180392.26A18000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptBinaryToStringW\" (Indicator: \"CryptBinaryToStringW\"; Source: \"00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp\")\n Found api reference \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003732.00000000.182675.0DBA0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003732.00000000.182675.0DBA0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006748.00000001.180392.26A18000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006748.00000001.180392.26A18000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00000752.00000000.183004.DCD0B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003732.00000000.182675.0DBA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006748.00000000.180124.24E90000.00000004.mdmp, 00000000-00006748.00000001.180392.24E90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"gtzvrbqrkxic.exe\" at offset 452633; code bytes = 30040e\n Found XOR loop in file \"gtzvrbqrkxic.exe\" at offset 1521759; code bytes = 30040e\n Found XOR loop in file \"dreamywarev3.exe\" at offset 452633; code bytes = 30040e\n Found XOR loop in file \"dreamywarev3.exe\" at offset 1521759; code bytes = 30040e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00001780.00000000.178999.08B70000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00001780.00000000.178999.08B70000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00001780.00000000.178999.08B70000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00001780.00000000.178999.08D60000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00001780.00000000.178999.08D60000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00001780.00000000.178999.08D60000.00000002.mdmp\")\n Found string \"etUserNameW\" (Source: \"00000000-00006748.00000001.180392.26A18000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00006748.00000001.180392.26A18000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00006748-00000C2C-1776220200\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00006748-00000C2C-1776220660\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006748-00000C2C-1778744067\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006748-00000C2C-1778744101\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00006748-00000C2C-1778382007\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00006748-00000C2C-1778382037\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001780.00000000.178999.06D80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006748)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6985a3e4b58e30d7f808390f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"