23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 3428e9fb2d25… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3428e9fb2d25…. Malware family: Trojan.Agent. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca"],"about":{"@type":"SoftwareApplication","name":"byAliceforyouOurSexPhotosiwantyou.exe","applicationCategory":["peexe","executable"],"identifier":"3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T195f,"byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002028) "byAliceforyouOurSexPhotosiwantyou.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00002028)25:T8063,Found reference to API (Indicator: "CloseServiceHandle"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CreateServiceA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "OpenSCManagerA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetTcpStatistics"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetIfTable"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetFileType"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "TerminateProcess"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "HeapSize"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetFilePointer"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "RtlUnwind"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetLastError"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "ReadFile"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "Sleep"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CloseHandle"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FormatMessageA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetCPInfo"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "lstrcatA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CreateFileA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetOEMCP"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "HeapFree"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "VirtualFree"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetLastError"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "VirtualQuery"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "RaiseException"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "TlsAlloc"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "lstrcpyA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GlobalFree"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CreateThread"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetStdHandle"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "TlsSetValue"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "HeapAlloc"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "TlsFree"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "lstrlenA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LCMapStringW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetLocalTime"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "TlsGetValue"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetTickCount"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetACP"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetProcAddress"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetStdHandle"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LCMapStringA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "HeapCreate"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "WriteFile"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetHandleCount"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "ExitProcess"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "NetShareCheck"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "VariantInit"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "RpcErrorStartEnumeration"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "RpcMgmtSetServerStackSize"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetupDiGetClassDevsA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SHGetFolderPathA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LoadImageA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetMessageA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LoadIconA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetMenu"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CharNextA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetRect"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "BeginPaint"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetFocus"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "InvalidateRect"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetWindowRect"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetTopWindow"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SendMessageA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetWindowPos"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetFocus"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "MessageBoxA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "SetCapture"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "PtInRect"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "UpdateWindow"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetWindow"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetDC"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "ReleaseDC"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "ShowWindow"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "closesocket"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "inet_addr"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "WSASocketA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CoGetClassObject"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "OleInitialize"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "EncodePointer"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "DecodePointer"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FlsFree"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FlsSetValue"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FlsGetValue"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "FlsAlloc"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetSaveFileName"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "GetOpenFileName"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileName"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileName"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "WSASocketA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "NetShareCheck"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetIfTable"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetTcpStatistics"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "RpcErrorStartEnumeration"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "RpcMgmtSetServerStackSize"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetupDiGetClassDevsA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002028.00000001.143209.032B0000.00000004.mdmp")26:T4c6,"byAliceforyouOurSexPhotosiwantyou.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74850000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74850000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74850000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "KERNEL32" at base 746b0000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72720000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "RPCRT4.DLL" at base 771b0000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "OLEAUT32.DLL" at base 773b0000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "KERNEL32.DLL" at base 746b0000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739b0000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "COMDLG32.DLL" at base 74af0000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75830000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "DCIMAN32.DLL" at base 72710000 "byAliceforyouOurSexPhotosiwantyou.exe" loaded module "COMCTL32" at base 72b3000027:T67d,"byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "")28:Td6d,"byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "BYALICEFORYOUOURSEXPHOTOSIWANTYOU.EXE"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "BYALICEFORYOUOURSEXPHOTOSIWANTYOU"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "byAliceforyouOurSexPhotosiwantyou.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "")29:T424,"byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\byAliceforyouOurSexPhotosiwantyou.exe" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\BYALICEFORYOUOURSEXPHOTOSIWANTYOU.EXE.LOCAL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to touch file "C:\NETAPI32.DLL"2a:T7bd,"byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\NETAPI32.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\MSVFW32.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\AVIFIL32.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\OPENGL32.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\OLEACC.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\OLEDLG.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\WINMM.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\MSACM32.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\GLU32.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\SRVCLI.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\OLEACCRC.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\FLTLIB.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\SAMCLI.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\DEVOBJ.DLL" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\DEVOBJ.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "byAliceforyouOurSexPhotosiwantyou.exe" trying to access non-existent file "C:\DCIMAN32.DLL"2b:T666,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "byAliceforyouOurSexPhotosiwantyou.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002028.00000001.143209.00412000.00000002.mdmp")2c:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790335674399,"unified_at":"2026-09-25T11:27:54.399Z","metadata":{"hashes":{"sha256":"3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca","sha1":"62286061f8af90628933170f9fdf1c0fc0f55c78","md5":"cab29bebcac337c44a5e11f7a54467ff","sha512":"e9bd843378aadf0736c71b3250b1ae055bc6990f95a612bd27b7006acb4c4b23d25e4dedd42a75af467cdb7fb9b6fc7439391a66c209369af7b15c71bbaf93a4","ssdeep":"3072:xWusqWOJgkk725cduyBKaEQ4VvI7owgPYV3CpaWFZfdyn5oV:KqWugb3ddBgQ4u7owgQQaWfV","ssdeep_chunks":["3072:xWusqWO","3072:WusqWOJ","3072:usqWOJg","3072:sqWOJgk","3072:qWOJgkk","3072:WOJgkk7","3072:OJgkk72","3072:Jgkk725","3072:gkk725c","3072:kk725cd","3072:k725cdu","3072:725cduy","3072:25cduyB","3072:5cduyBK","3072:cduyBKa","3072:duyBKaE","3072:uyBKaEQ","3072:yBKaEQ4","3072:BKaEQ4V","3072:KaEQ4Vv","3072:aEQ4VvI","3072:EQ4VvI7","3072:Q4VvI7o","3072:4VvI7ow","3072:VvI7owg","3072:vI7owgP","3072:I7owgPY","3072:7owgPYV","3072:owgPYV3","3072:wgPYV3C","3072:gPYV3Cp","3072:PYV3Cpa","3072:YV3CpaW","3072:V3CpaWF","3072:3CpaWFZ","3072:CpaWFZf","3072:paWFZfd","3072:aWFZfdy","3072:WFZfdyn","3072:FZfdyn5","3072:Zfdyn5o","3072:fdyn5oV","6144:xWusqWO","6144:WusqWOJ","6144:usqWOJg","6144:sqWOJgk","6144:qWOJgkk","6144:WOJgkk7","6144:OJgkk72","6144:Jgkk725","6144:gkk725c","6144:kk725cd","6144:k725cdu","6144:725cduy","6144:25cduyB","6144:5cduyBK","6144:cduyBKa","6144:duyBKaE","6144:uyBKaEQ","6144:yBKaEQ4","6144:BKaEQ4V","6144:KaEQ4Vv","6144:aEQ4VvI","6144:EQ4VvI7","6144:Q4VvI7o","6144:4VvI7ow","6144:VvI7owg","6144:vI7owgP","6144:I7owgPY","6144:7owgPYV","6144:owgPYV3","6144:wgPYV3C","6144:gPYV3Cp","6144:PYV3Cpa","6144:YV3CpaW","6144:V3CpaWF","6144:3CpaWFZ","6144:CpaWFZf","6144:paWFZfd","6144:aWFZfdy","6144:WFZfdyn","6144:FZfdyn5","6144:Zfdyn5o","6144:fdyn5oV","3072:KqWugb3","3072:qWugb3d","3072:Wugb3dd","3072:ugb3ddB","3072:gb3ddBg","3072:b3ddBgQ","3072:3ddBgQ4","3072:ddBgQ4u","3072:dBgQ4u7","3072:BgQ4u7o","3072:gQ4u7ow","3072:Q4u7owg","3072:4u7owgQ","3072:u7owgQQ","3072:7owgQQa","3072:owgQQaW","3072:wgQQaWf","3072:gQQaWfV"],"imphash":"e2c05b865de4b1833da973b049afa7ea"},"file_info":{"file_name":"byAliceforyouOurSexPhotosiwantyou.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":207496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287983000,"last_seen":1775765565000,"last_multi_scan":1775765565000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":56},"sandbox_signatures":{"informative_count":112,"suspicious_count":15,"malicious_count":6,"total":133},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Kryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Cerber.smnle","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CDND","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CDND (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FOHP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005fe0261 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AVHJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FLDP!CAB29BEBCAC3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.MBIZ-5545","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes.Win32.69417","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"suspicious","value":"Calls an API typically used to find device information"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 26349-600-0040D280\n SetUnhandledExceptionFilter@KERNEL32.dll at 26349-1490-00409428\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018769-00002420-37179-17-00404A02\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018769-00002420-37179-16-00404E6D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018769-00002420-37179-554-00409428\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018769-00002420-37179-246-0040D280","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00018769-00002420-37179-143-004051A6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018769-00002420-37179-207-00409AAC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00018769-00002420-37179-59-00402DD0","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetDiskFreeSpaceW@KERNEL32.DLL (Target: \"byAliceforyouOurSexPhotosiwantyou.exe\"; Stream UID: \"00018769-00002420-37179-59-00402DD0\")\n which is directly followed by \"cmp edx, ebx\" and \"jne 0040373Ah\". See related instructions: \"...\n+2365 mov dword ptr [esp+4Ch], ebx\n+2369 call dword ptr [004120F0h] ;GetDiskFreeSpaceW\n+2375 add esi, dword ptr [esp+64h]\n+2379 mov ecx, dword ptr [esp+6Ch]\n+2383 mov dword ptr [esp+1Ch], esi\n+2387 mov esi, dword ptr [esp+58h]\n+2391 xor edx, edx\n+2393 lea edi, dword ptr [ecx+01h]\n+2396 mov eax, esi\n+2398 div edi\n+2400 cmp edx, ebx\n+2402 jne 0040373Ah\" ... at 00018769-00002420-37179-59-00402DD0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00018769-00002420-37179-79-0040106A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/41 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\spews\\MPC\\Warcraft\\directory\\cr.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\MSVFW32.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\OLEACCRC.DLL\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\OLEACCRC.DLL.mui\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"byAliceforyouOurSexPhotosiwantyou.exe.bin\" was detected as \"Microsoft Visual C++ 8\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00018769-00002420-00000105-55570095","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.51129218185","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"byAliceforyouOurSexPhotosiwantyou.exe.bin\" claimed CRC 255641 while the actual is CRC 244025","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateServiceA\n WriteFile\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n CreateThread\n TerminateProcess\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetProcAddress\n CreateFileMappingA\n CreateFileA\n GetCommandLineA\n GetModuleHandleW\n Sleep\n VirtualAlloc\n WSASocketA\n bind (Ordinal #2)\n WSASendTo\n closesocket (Ordinal #3)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/56 Antivirus vendors marked sample as malicious (12% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"V:\\\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"unknown compression method\" (Source: \"00000000-00002028.00000000.141288.0041B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" queried SystemProcessInformation at 00000000-00002028-00000C15-1137048922 [PID: 2028]\n \"byAliceforyouOurSexPhotosiwantyou.exe\" queried SystemProcessInformation at 00000000-00002028-00000C15-1137057398 [PID: 2028]\n \"byAliceforyouOurSexPhotosiwantyou.exe\" queried SystemProcessInformation at 00000000-00002028-00000C15-1137161924 [PID: 2028]\n \"byAliceforyouOurSexPhotosiwantyou.exe\" queried SystemProcessInformation at 00000000-00002028-00000C15-1137170684 [PID: 2028]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 20056-185-00408818\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 20056-185-00408818\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 20056-600-0040D280\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 20056-639-0040B777\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 20056-639-0040B777\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 20056-640-0040D6F1\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 20056-640-0040D6F1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.15361","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 145755; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 19924; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 20545; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 170222; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 107268; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 158722; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 201308; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"byAliceforyouOurSexPhotosiwantyou.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"byAliceforyouOurSexPhotosiwantyou.exe\"\n Found system information discovery API: \"GetEnvironmentStrings\" in file \"byAliceforyouOurSexPhotosiwantyou.exe\"\n Found system information discovery API: \"GetUserObjectInformationA\" in file \"byAliceforyouOurSexPhotosiwantyou.exe\"\n Found system information discovery API: \"GetUserObjectInformationA\" in \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStrings\" in \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"SetupDiGetClassDevsA\" with parameters (UID: 00000000-00002028)\n \"byAliceforyouOurSexPhotosiwantyou.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BYALICEFORYOUOURSEXPHOTOSIWANTYOU.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002028)\n \"byAliceforyouOurSexPhotosiwantyou.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002028)\n \"byAliceforyouOurSexPhotosiwantyou.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002028)\n \"byAliceforyouOurSexPhotosiwantyou.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002028)\n \"byAliceforyouOurSexPhotosiwantyou.exe\" called \"LoadLibrary\" with a parameter COMDLG32.DLL (UID: 00000000-00002028)\n \"byAliceforyouOurSexPhotosiwantyou.exe\" called \"LoadLibrary\" with a parameter comctl32 (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$24","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"SHCreateDirectoryExA\" (Indicator: \"CreateDirectory\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SHCreateDirectoryExA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: byAliceforyouOurSexPhotosiwantyou.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00002028.00000001.143209.032B0000.00000004.mdmp\n \"th=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B31118B2-1F49-48E5\" in Source: 00000000-00002028.00000001.143209.032B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process byAliceforyouOurSexPhotosiwantyou.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2028:168:WilStaging_02\"\n Process byAliceforyouOurSexPhotosiwantyou.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2028:64:WilError_01\"\n Process byAliceforyouOurSexPhotosiwantyou.exe created mutex with name \"SM0:2028:64:WilError_01\"\n Process byAliceforyouOurSexPhotosiwantyou.exe created mutex with name \"Local\\SM0:2028:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00002028.00000001.143209.032B0000.00000004.mdmp\n \"th=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{B31118B2-1F49-48E5\" in Source: 00000000-00002028.00000001.143209.032B0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$26","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74DB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 771B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" touched \"Shell Automation Service\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{13709620-C279-11CE-A49E-444553540000}\")\n \"byAliceforyouOurSexPhotosiwantyou.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" file has an entrypoint instructions - \"call\t0x409aac,jmp\t0x405642,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],test\tecx, 3,je\t0x405800,mov\tal, byte ptr [ecx],add\tecx, 1,test\tal, al,je\t0x405833,test\tecx, 3,jne\t0x4057dc,add\teax, 0,lea\tesp, [esp],lea\tesp, [esp],mov\teax, dword ptr [ecx],mov\tedx, 0x7efefeff,add\tedx, eax,xor\teax, 0xffffffff,xor\teax, edx,add\tecx, 4,test\teax, 0x81010100,je\t0x405800,mov\teax, dword ptr [ecx - 4],test\tal, al,je\t0x405851,test\tah, ah,je\t0x405847,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"byAliceforyouOurSexPhotosiwantyou.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"byAliceforyouOurSexPhotosiwantyou.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" queries basic process information of the \"C:\\byAliceforyouOurSexPhotosiwantyou.exe\" (UID: 2028)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Calls an API typically used to find device information","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" trying to access non-existent file \"C:\\BYALICEFORYOUOURSEXPHOTOSIWANTYOU.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"09.bm\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2DEFA1F4C667A702428A6C211957]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"2718748098,7204,3025,,RtlGetNtProductType,NTDLL.dll,\"00:36:44.171\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002028.00000000.141288.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: byAliceforyouOurSexPhotosiwantyou.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002028.00000000.141288.032B0000.00000004.mdmp, 00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002028.00000000.141288.032B0000.00000004.mdmp, 00000000-00002028.00000001.143209.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00002028.00000000.141288.032B0000.00000004.mdmp\n 00000000-00002028.00000001.143209.032B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"byAliceforyouOurSexPhotosiwantyou.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002028.00000001.143209.00412000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\DRAWDIB\"; Key: \"1280X1024X32(BGR 0)\"; Value: \"31\n31\n31\n31\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"FlsFree\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsSetValue\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsGetValue\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: KERNELBASE.DLL)\n Found string \"FlsAlloc\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetProcessWindowStation\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: USER32.DLL)\n Found string \"GetUserObjectInformationA\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: USER32.DLL)\n Found string \"GetLastActivePopup\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: byAliceforyouOurSexPhotosiwantyou.exe, API is part of module: USER32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" has section name .rsrc with entropy \"7.51129218185204\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to find device information","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"SetupDiGetClassDevsA\" with parameters {\"ClassGuid\": \"00000000000000000000000000000000\"\n \"Flags\": \"18\"}","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-193","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 20056-685-0040F142","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 20056-1-004057C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"BINDATA:7.964791344408106\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"BINDATA:7.948956955094478\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"RCDATA:7.90144882575\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"RCDATA:7.914749865835619\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"RCDATA:7.681609498182532\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"RCDATA:7.674998543738518\"\n \"byAliceforyouOurSexPhotosiwantyou.exe\" has resource with unusual entropy \"RCDATA:7.955079141671151\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00002028.00000000.141288.032B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"byAliceforyouOurSexPhotosiwantyou.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1e0107ec\"\n \"cx\": \"20\"\n \"cy\": \"2\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 20056-1-004057C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"},{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":84,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"69d8083c8ecaa7e4dd0d1ccb","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Agent","submit_name":"byAliceforyouOurSexPhotosiwantyou.exe","analysis_start_time":"2026-04-09T20:12:45+00:00","indicators_count":{"informative":106,"suspicious":17,"malicious":3},"is_in_unified_schema":true},{"id":"58990146aac2edcc2c7b5666","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":44,"malware_family":"virtool.win32.injector","submit_name":"byAliceforyouOurSexPhotosiwantyou.exe","analysis_start_time":"2017-02-07T00:06:00+00:00","indicators_count":{"informative":11,"suspicious":8,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}],"processes":[{"pid":2420,"ppid":0,"name":"byAliceforyouOurSexPhotosiwantyou.exe","command_line":"","normalized_path":"C:\\byAliceforyouOurSexPhotosiwantyou.exe","uid":"00018769-00002420","icon":"$2c"}],"all_imported_dlls":["msvcrt.dll","advapi32.dll","sechost.dll","shell32.dll","ole32.dll","srvcli.dll","rasadhlp.dll","webio.dll","mpr.dll","ntdll.dll","kernel32.dll","ws2_32.dll","netutils.dll","winmm.dll","IPHLPAPI.DLL","cfgmgr32.dll","imm32.dll","oleacc.dll","wintrust.dll","dnsapi.dll","clbcatq.dll","profapi.dll","rsaenh.dll","msasn1.dll","WSHTCPIP.DLL","wship6.dll","msacm32.dll","msctf.dll","mswsock.dll","cryptbase.dll","cryptsp.dll","usp10.dll","opengl32.dll","oleaccrc.dll","credssp.dll","oleaut32.dll","wkscli.dll","glu32.dll","comctl32.dll","GdiPlus.dll","user32.dll","rpcrt4.dll","ddraw.dll","dciman32.dll","crypt32.dll","wlanutil.dll","KernelBase.dll","lpk.dll","avifil32.dll","winnsi.dll","devobj.dll","dwmapi.dll","winhttp.dll","nsi.dll","netapi32.dll","msvfw32.dll","uxtheme.dll","secur32.dll","wlanapi.dll","setupapi.dll","shlwapi.dll","oledlg.dll","sspicli.dll","gdi32.dll","comdlg32.dll","RpcRtRemote.dll","ucrtbase.dll","winmmbase.dll","msvcp_win.dll","win32u.dll","fltLib.dll","combase.dll","bcryptprimitives.dll","SHCore.dll","wow64win.dll","wow64.dll","apphelp.dll","kernel.appcore.dll","VxSSL32.dll","powrprof.dll","gdi32full.dll","windows.storage.dll","samcli.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\system32\\en-US\\MSVFW32.dll.mui","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"C:\\`","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"%WINDIR%\\system32\\en-US\\OLEACCRC.DLL.mui","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"UNC\\`\\pipe\\svcctl","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"C:\\byAliceforyouOurSexPhotosiwantyou.exe","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\DRAWDIB\\","sources":[{"report_type":"sandbox","report_id":"58990146aac2edcc2c7b5666"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\DRAWDIB\\","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"name":"SM0:2028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]},{"name":"Local\\SM0:2028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69d8083c8ecaa7e4dd0d1ccb"}]}]}},"report_ids":{"sandbox_job_ids":["69d8083c8ecaa7e4dd0d1ccb","58990146aac2edcc2c7b5666"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 3428e9fb2d25… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3428e9fb2d25…. Malware family: Trojan.Agent. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 3428e9fb2d25… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3428e9fb2d25…. Malware family: Trojan.Agent. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3428e9fb2d250ff24621f948f061f0ed12fba0a210ada1e38b83c8af5a09f0ca"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 3428e9fb2d25… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3428e9fb2d25…. Malware family: Trojan.Agent. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]